summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rwxr-xr-xgen-cipher-test364
-rwxr-xr-xgenerate-wireshark-cs160
-rw-r--r--notes.txt105
-rw-r--r--ssl3/ciphers-V-ssl3.txt39
-rw-r--r--ssl3/debug.txt18073
-rw-r--r--ssl3/dump.pcapngbin0 -> 140088 bytes
-rw-r--r--ssl3/not-ssl3-urls.txt44
-rw-r--r--ssl3/premaster.txt78
-rw-r--r--ssl3/ssl3-urls.txt39
-rw-r--r--suites.txt314
-rw-r--r--tls/all/ciphers-V-broken.txt33
-rw-r--r--tls/all/ciphers-V-works.txt6
-rw-r--r--tls/all/debug.txt20504
-rw-r--r--tls/all/dump.pcapngbin0 -> 152764 bytes
-rw-r--r--tls/all/premaster.txt78
-rw-r--r--tls/all/tls-urls.txt39
-rw-r--r--tls/all/wireshark-broken.txt33
-rw-r--r--tls/all/wireshark-works.txt6
-rw-r--r--tls/broken/debug.txt16741
-rw-r--r--tls/broken/dump.pcapngbin0 -> 130756 bytes
-rw-r--r--tls/broken/premaster.txt66
-rw-r--r--tls/works/debug.txt2685
-rw-r--r--tls/works/dump.pcapngbin0 -> 22360 bytes
-rw-r--r--tls/works/premaster.txt12
24 files changed, 59419 insertions, 0 deletions
diff --git a/gen-cipher-test b/gen-cipher-test
new file mode 100755
index 0000000..73593b0
--- /dev/null
+++ b/gen-cipher-test
@@ -0,0 +1,364 @@
+#!/bin/bash
+# Generate nginx config and HTML for testing ciphers
+# Author: Peter Wu <lekensteyn@gmail.com>
+
+#domain=ciphertest.lekensteyn.nl
+# ssl-enabled ip:port, may occur multiple times space-separated
+# PORT will be replaced for a number that increments for every test
+#listen=$domain:PORT
+domain=${1:-local.al.lekensteyn.nl}
+address=localhost
+listen="$address:4433 $address:PORT "
+portbase=4433
+
+pkdir=certs/
+rsa_prv=server.pem
+rsa_pub=server.crt
+dsa_prv=dsa.pem
+dsa_pub=dsa.crt
+#ecc_prv=ec.pem
+#ecc_pub=ec.crt
+ecc_prv=secp384r1.pem
+ecc_pub=secp384r1.crt
+dh_params=dhparams.pem
+
+root=/srv/http/ciphertest
+html="$root/index.html"
+
+get_ciphers() {
+ # output: index (n1 << 8 | n2) name version auth line
+ openssl ciphers -V | sort -n |
+ awk -F'[ ,]+' '{ print ++i, $2, $3, $5, $6, substr($8, 4), $0 }'
+}
+htmlescape() {
+ sed 's/&/&amp;/g;s/</\&lt/g;s/>/\&gt;/g'
+}
+
+#if [ ! -s "$html" ]; then
+if true; then # always generate file
+cat > "$html" <<EOF
+<!doctype html>
+<html>
+<head>
+<meta charset=utf-8>
+<title>Cipher suite test</title>
+<style>
+iframe {
+ width: 800px;
+ height: 1.5em;
+ display: block;
+}
+label {
+ font-family: monospace;
+}
+#openssl-version {
+ white-space: pre-line;
+ font-family: monospace;
+}
+.cipher-unknown {
+ background-color: #ccc;
+}
+.cipher-ok {
+ background-color: lightgreen;
+}
+.cipher-nok {
+ background-color: pink;
+}
+#hide-unknown:checked ~ #opts .cipher-unknown,
+#hide-nok:checked ~ #opts .cipher-nok,
+#hide-ok:checked ~ #opts .cipher-ok,
+#hide-checks:checked ~ #opts input[type=checkbox],
+#hide-frames:checked ~ #opts iframe {
+ display: none;
+}
+</style>
+</head>
+<body>
+
+<div id="openssl-version">
+$(openssl version -a | htmlescape)
+</div>
+
+<form id="frm" action="javascript:">
+ <label><input type="checkbox" id="toggle-all">Toggle all</label>
+
+ <button id="delayed_executor">Check boxes (delayed)</button>
+
+ <input type="checkbox" id="hide-frames">
+ <label for="hide-frames">Hide frames</label>
+
+ <input type="checkbox" id="hide-checks">
+ <label for="hide-checks">Hide checkboxes</label>
+
+ <br>
+ Hide cipher suites:
+
+ <input type="checkbox" id="hide-unknown">
+ <label for="hide-unknown">Hide unknown</label>
+
+ <input type="checkbox" id="hide-nok">
+ <label for="hide-nok">Hide nok</label>
+
+ <input type="checkbox" id="hide-ok">
+ <label for="hide-ok">Hide ok</label>
+
+ <fieldset id="opts">
+ </fieldset>
+</form>
+
+<script>
+"use strict";
+var ciphers = [
+$(get_ciphers | while read i n1 n2 name version auth line; do
+ printf '{number:%s, name:"%s", version:"%s", auth:"%s", port:%i},\n' \
+ $((n1*0x100+n2)) "$name" "$version" "$auth" $((portbase + i))
+done)
+];
+var opts = document.getElementById("opts");
+var toggler = document.getElementById("toggle-all");
+var frame_path = "/";
+
+document.domain = "$domain";
+
+function frame_handler(ev) {
+ var ifr = document.getElementById("ifr-" + this.value);
+ var port = this.dataset.port;
+ var url = "//" + this.value + ".$domain:" + port + frame_path;
+ ifr.src = this.checked ? url : "";
+}
+
+function toggle_handler(ev) {
+ var opts = document.getElementsByClassName("cipher-choices");
+ for (var i = 0; i < opts.length; i++) {
+ if (this.checked != opts[i].checked)
+ opts[i].click();
+ }
+}
+
+(function (trigger) {
+ var delayer = null;
+ var current_index;
+ var opts = document.getElementsByClassName("cipher-choices");
+
+ function stop_delayer() {
+ clearInterval(delayer);
+ delayer = null;
+ }
+
+ function delayed_opener() {
+ if (current_index < opts.length) {
+ if (!opts[current_index].checked)
+ opts[current_index].click();
+
+ current_index++;
+ } else {
+ stop_delayer();
+ toggler.checked = true;
+ }
+ }
+
+ function start_timer(interval) {
+ if (delayer) {
+ console.log("Timer already active");
+ return;
+ }
+
+ current_index = 0;
+ delayer = setInterval(delayed_opener, interval);
+ }
+
+ trigger.addEventListener("click", function (ev) {
+ var interval = parseInt(prompt("Delay (msec). 0 is stop", 300));
+ if (isNaN(interval) || interval < 0) {
+ console.log("Invalid interval - ignoring");
+ return;
+ }
+
+ if (interval > 0)
+ start_timer(interval);
+ else
+ stop_delayer();
+ });
+})(document.getElementById("delayed_executor"));
+
+function get_container_for_frame(ifr) {
+ return document.getElementById("ctr-" + ifr.id.replace("ifr-", ""));
+}
+
+function frame_loaded() {
+ var ctr = get_container_for_frame(this);
+ var cipher = ctr.dataset.cipher.toLowerCase();
+ var cipherFound = null;
+
+ if (!this.src) {
+ return;
+ }
+
+ console.log("Loaded: " + this.src);
+ try {
+ var line = this.contentDocument.body.firstChild.textContent;
+ cipherFound = line.toLowerCase().indexOf(cipher) != -1;
+ console.log("looking for '" + cipher + "' in: " + line);
+ } catch (ex) {
+ console.log(ex);
+ }
+
+ if (cipherFound === null) {
+ ctr.className = "cipher-unknown";
+ } else if (cipherFound) {
+ ctr.className = "cipher-ok";
+ } else {
+ ctr.className = "cipher-nok";
+ }
+}
+function frame_error() {
+ var ctr = get_container_for_frame(this);
+
+ console.log("Error while loading: " + this.src);
+ ctr.className = "cipher-nok";
+}
+
+toggler.addEventListener("change", toggle_handler);
+
+ciphers.forEach(function (cipher, i) {
+ var container = document.createElement("div");
+ container.id = "ctr-" + cipher.name;
+ container.dataset.cipher = cipher.name;
+ container.className = "cipher-unknown";
+
+ var hexid = "0x" + ("000" + cipher.number.toString(16)).substr(-4).toUpperCase();
+
+ var lbl = document.createElement("label");
+ lbl.id = "lbl-" + cipher.name;
+ lbl.textContent = hexid + " " + cipher.name + " (" + cipher.version +
+ ", Au=" + cipher.auth + ") #" + i;
+
+ var opt = document.createElement("input");
+ opt.type = "checkbox";
+ opt.value = cipher.name;
+ opt.dataset.port = cipher.port;
+ opt.className = "cipher-choices";
+ opt.addEventListener("change", frame_handler);
+ lbl.insertBefore(opt, lbl.firstChild);
+
+ var ifr = document.createElement("iframe");
+ ifr.id = "ifr-" + cipher.name;
+ ifr.onload = frame_loaded;
+ ifr.onerror = frame_error;
+
+ container.appendChild(ifr);
+ container.appendChild(lbl);
+
+ opts.appendChild(container);
+});
+</script>
+
+</body>
+</html>
+EOF
+fi
+
+# Begin nginx config generator
+
+get_common() {
+ local auth=$1
+ local port=${2:-$portbase}
+ local crtfile keyfile dhpfile
+
+ case $auth in
+ RSA)
+ crtfile=$rsa_pub
+ keyfile=$rsa_prv
+ ;;
+ ECDH)
+ # Note: NSS does not support all cipher suites from OpenSSL, but OpenSSL
+ # cannot work with ECDH-RSA using th below certificates.
+ crtfile=$ecc_pub
+ keyfile=$ecc_prv
+ #dhpfile=$dh_params
+ ;;
+ DSS)
+ crtfile=$dsa_pub
+ keyfile=$dsa_prv
+ ;;
+ ECDSA)
+ crtfile=$ecc_pub
+ keyfile=$ecc_prv
+ #dhpfile=$dh_params
+ ;;
+ PSK)
+ #echo "Unknown Au=$auth - using RSA" >&2
+ crtfile=$rsa_pub
+ keyfile=$rsa_prv
+ ;;
+ *)
+ echo "Unknown Au=$auth - using RSA" >&2
+ crtfile=$rsa_pub
+ keyfile=$rsa_prv
+ ;;
+ esac
+
+ local listens l
+ listens=$(echo ${listen//PORT/$port} | tr ' ' '\n' | sort -u | tr '\n' ' ')
+ for l in $listens; do
+ echo " listen $l ssl;"
+ done
+
+cat <<EOF
+ ssl_certificate $pkdir$crtfile;
+ ssl_certificate_key $pkdir$keyfile;
+EOF
+ [ -z "$dhpfile" ] || cat <<EOF
+ ssl_dhparam $pkdir$dhpfile;
+EOF
+cat <<EOF
+ ssl_prefer_server_ciphers on;
+ expires epoch;
+ keepalive_timeout 0s;
+ root $root;
+EOF
+}
+cat <<EOF
+server {
+$(get_common RSA)
+ default_type "text/plain";
+ access_log off;
+ return 200 "Invalid host - is SNI enabled?";
+}
+
+server {
+$(get_common RSA)
+ server_name $domain www.$domain;
+}
+
+EOF
+
+# WARNING: BROKEN CONFIG for server blocks sharing same listen address and port.
+# If SNI is not available, the first server block will be loaded for
+# certificates and ciphers. Once the host (via Host header) is known, it will
+# return the "OK" response.
+
+get_ciphers |
+while read i n1 n2 name version auth line; do
+ num=$(($n1*0x100 + $n2)) # 49169
+ hex=$n1${n2:2} # 0xC011
+
+ cat <<EOF
+server { # cipher suite #$i
+$(get_common $auth $((portbase+i)))
+ server_name ${hex,,}.$domain $num.$domain ${name,,}.$domain;
+ ssl_ciphers -ALL:$name;
+ #ssl_protocols $version;
+ default_type "text/html";
+ access_log off;
+ location = / {
+ return 200 "$line<script>document.domain='$domain'</script>";
+ }
+}
+
+EOF
+done
+
+cat <<EOF
+# vim: set et sw=4 ts=4:
+EOF
diff --git a/generate-wireshark-cs b/generate-wireshark-cs
new file mode 100755
index 0000000..65c4503
--- /dev/null
+++ b/generate-wireshark-cs
@@ -0,0 +1,160 @@
+#!/bin/bash
+# Quick 'n' dirty generator for extending wireshark cipher suites
+# Author: Peter Wu <lekensteyn@gmail.com>
+
+set -u
+
+p() {
+ local tmp kex sig keysize dig diglen mode us_export blocksize
+ [ $# -gt 0 ] || return
+ num=$(($2*0x100 + $3))
+
+ tmp=${1%%_WITH_*}
+ tmp=${tmp#TLS_}
+ case $tmp in
+ RSA) kex=RSA ;;
+ DH_*|DHE_*) kex=DH ;;
+ ECDH_*|ECDHE_*) kex=DH ;;
+ *)
+ echo "Unknown kex in $1 (tmp=$tmp)" >&2
+ return
+ ;;
+ esac
+
+ tmp=${1%%_WITH_*}
+ tmp=${tmp#TLS_}
+ tmp=${tmp#EC}
+ tmp=${tmp#DH_}
+ tmp=${tmp#DHE_}
+ case $tmp in
+ RSA|DSS) sig=$tmp ;;
+ ECDSA) sig=DSS ;;
+ anon) sig=NONE ;;
+ *)
+ echo "Unknown sig in $1 (tmp=$tmp)" >&2
+ return
+ ;;
+ esac
+
+ # HACK HACK HACK
+ tmp=${1#*WITH_}
+ cipher=${tmp%%_*}
+ tmp=${tmp#${cipher}_} # now continue for keysize
+ keysize=${tmp%%_*}
+ [[ $keysize != [0-9]* ]] || cipher=$cipher$keysize
+ case $cipher in
+ *128|*256) ;;
+ SEED) keysize=128 ;;
+ NULL) keysize=0 ;;
+ 3DES)
+ if [[ $keysize == EDE ]]; then
+ keysize=192
+ else
+ echo "Invalid keysize in $1 (cipher=$cipher, keysize=$keysize)" >&2
+ #return
+ fi
+ ;;
+ *)
+ echo "Invalid keysize in $1 (cipher=$cipher, keysize=$keysize)" >&2
+ #return
+ ;;
+ esac
+
+ case $cipher in
+ AES128)
+ cipher=AES
+ ;;
+ DES|3DES|RC4|RC2|IDEA|AES256|CAMELLIA128|CAMELLIA256|NULL) ;;
+ SEED*) cipher=SEED ;;
+ RC4128) cipher=RC4 ;;
+ *)
+ echo "Unknown cipher $cipher" >&2
+ return
+ ;;
+ esac
+
+ case $cipher in
+ AES|AES256|CAMELLIA128|CAMELLIA256|SEED)
+ blocksize=16 ;;
+ DES|3DES)
+ blocksize=8 ;;
+ RC2|RC4|NULL)
+ blocksize=1 ;;
+ *)
+ echo "Unknown cipher $cipher" >&2
+ return
+ ;;
+ esac
+
+ dig=${1##*_}
+ case $dig in
+ MD5) diglen=16 ;;
+ SHA) diglen=20 ;;
+ SHA256) diglen=32 ;;
+ SHA384) diglen=48 ;;
+ *)
+ echo "Unknown dig in $1 (dig=$dig)" >&2
+ return
+ ;;
+ esac
+
+ us_export=0
+
+ # mode=STREAM
+ case $cipher in
+ AES|AES256|DES|3DES|CAMELLIA128|CAMELLIA256|SEED)
+ mode=CBC ;;
+ RC2|RC4|NULL)
+ mode=STREAM ;;
+ *)
+ echo "Unknown mode in $1 (cipher=$cipher)" >&2
+ return
+ ;;
+ esac
+
+cat <<EOF
+ {$num,KEX_$kex,SIG_$sig,ENC_$cipher,$blocksize,$keysize,$keysize,DIG_$dig,$diglen,$us_export, SSL_CIPHER_MODE_$mode}, /* $1 */
+EOF
+}
+
+# expects a line like:
+# CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x41 };
+sed 's/CipherSuite//;s/,/ /g' | grep -v '^[ \t]*$' | tr -d '={};' | while read name n1 n2 rem; do
+ if [ -n "$rem" ]; then
+ echo "Error! Invalid line: $name $n1 $n2 $rem" >&2
+ continue
+ fi
+ p "$name" "$n1" "$n2"
+done
+exit
+
+# from http://tools.ietf.org/html/rfc5932, Proposed Cipher Suites
+
+p TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x00 0x41
+p TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x00 0x42
+p TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x00 0x43
+p TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x00 0x44
+p TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x00 0x45
+p TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA 0x00 0x46
+p
+p TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x00 0x84
+p TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x00 0x85
+p TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x00 0x86
+p TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x00 0x87
+p TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x00 0x88
+p TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA 0x00 0x89
+p
+p
+p TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x00 0xBA
+p TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 0x00 0xBB
+p TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x00 0xBC
+p TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 0x00 0xBD
+p TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x00 0xBE
+p TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 0x00 0xBF
+p
+p TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x00 0xC0
+p TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 0x00 0xC1
+p TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x00 0xC2
+p TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 0x00 0xC3
+p TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x00 0xC4
+p TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 0x00 0xC5
diff --git a/notes.txt b/notes.txt
new file mode 100644
index 0000000..b081e69
--- /dev/null
+++ b/notes.txt
@@ -0,0 +1,105 @@
+/tmp/wireshark/configure --prefix=/tmp/wsroot --with-ssl --with-gtk2 --without-gtk3
+
+# find which suites are not supported yet (unsupported.txt)
+awk -vsrc=/tmp/wireshark/epan/dissectors/packet-ssl-utils.c -F'[ {,]+' 'BEGIN{while(getline <src)if(/^ *\{.*,KEX_/)a[$2]=1}{if(!a[$1])print}' suites.txt
+# find which ciphers openssl supports
+openssl ciphers -V | awk -F'[, ]+' '{print $2, $3, $5}' | while read n1 n2 name; do echo $(($n1*0x100 + $n2)) $name;done|sort -n > openssl-supported-ciphers.txt
+# find which ciphers are not yet supported (unsupported-new is from above)
+grep -E "$(cut -d' ' -f1 unsuppported-new.txt openssl-supported-ciphers.txt | sort | uniq -d | tr '\n' '|' | sed 's/|$//')" unsuppported-new.txt -w
+
+
+# command to use key file from NSS
+/tmp/wsroot/bin/wireshark -o ssl.keylog_file:$PWD/s_client-keys.txt s_client.capng -o http.ssl.port:4433 -o ssl.debug_file:s_client-debug.txt
+
+# Command to look for relation between cipher and mode (stream vs cbc)
+grep epan/dissectors/packet-ssl-utils.c -e '^ *{.*,KEX' | column -s, -t | sort -k 4,4 -k 11,11
+Bugs:
+- DES is a block cipher, this should probably become block instead of stream:
+ {98 KEX_RSA SIG_RSA ENC_DES 8 64 64 DIG_SHA 20 1 SSL_CIPHER_MODE_STREAM}
+- RC4 is a stream cipher, (block size = 1, not 16)
+ /*{138 KEX_PSK SIG_RSA ENC_RC4 16 128 128 DIG_SHA 20 0 SSL_CIPHER_MODE_CBC} */
+- length for a signature was wrong (16 should be 20)
+ {99 KEX_DH SIG_DSS ENC_DES 8 64 64 DIG_SHA 16 1 SSL_CIPHER_MODE_CBC}
+- IDEA is a block cipher ### VERIFIED
+# {7 KEX_RSA SIG_RSA ENC_IDEA 8 128 128 DIG_SHA 20 0 SSL_CIPHER_MODE_STREAM}
+- shouldn't a stream cipher operate on a block of 1? One of the two is wrong...
+ {6 KEX_RSA SIG_RSA ENC_RC2 8 128 40 DIG_SHA 20 1 SSL_CIPHER_MODE_STREAM}
+ {97 KEX_RSA SIG_RSA ENC_RC2 1 128 56 DIG_MD5 16 1 SSL_CIPHER_MODE_STREAM}
+- 27 is TLS_DH_anon_WITH_3DES_EDE_CBC_SHA, should become DIG_SHA,20
+ {27,KEX_DH,SIG_NONE,ENC_3DES,8,192,192,DIG_MD5,16,0, SSL_CIPHER_MODE_CBC},
+
+# pipe openssl
+stdbuf -oL openssl s_server -CAfile server.crt -cert server.crt -key server.pem -www -cipher ALL 2>&1 | awk '/ACCEPT/{print (++n) " " $0}!/ACCEPT/{print}{fflush()}'
+openssl ciphers | tr : '\n' > ciphers.txt
+# trigger tests:
+openssl ciphers|tr : '\n' | while read i;do echo;echo $i;curl --cacert /tmp/snif/pki/server.crt https://localhost:4433 -o /dev/null --ciphers $i -v;done
+# "fail" file is above output
+awk 'BEGIN{while(getline<"fail"){if(/ACCEPT/){n=$1}else if(/error/){fails[n]=1}}} {if(!fails[NR])print}' ciphers.txt
+
+
+# convert CipherSuite from RFC to code
+xsel | ./generate-wireshark-cs | sed s/{/,/ | sort -t, -n -k2,2 | sed s/,/{/
+# check for differences between existing ciphers and new ones from X clipboard
+ssort(){ sed s/{/,/ | sort -t, -k2,2 | sed s/,/{/; }
+grep ,KEX_ packet-ssl-utils.c | ssort > 1;(cat 1; xsel) | sort -t} -u | ssort > 2; colordiff -u 1 2
+
+
+# dump CLIENT_RANDOM for every cipher
+openssl ciphers|tr : '\n' | grep -vE '^(PSK|SRP|ECDHE-ECDSA|ECDH)-|-DSS-' | while read cipher; do (echo 'GET / HTTP/1.0';sleep .1) | openssl s_client -connect localhost:4433 -cipher $cipher -msg 2>&1 | awk '/Master-Key:/{key=$2} {b=1;e=16;if(l==3)b=7;if(l==1)e=6;for(i=b;i<=e;i++)s=s$i;if(l--==1)r[s]=1}/ ClientHello|ServerHello$/{l=3;s=""} END{for(rnd in r)print "CLIENT_RANDOM",rnd,key}';done > all/s_client-keys.txt
+# dump CLIENT_RANDOM for every cipher for *.local.al.lekensteyn.nl with TLS disabled
+for url in $(grep -E '/(IDEA-CBC-SHA|EXP-RC2-CBC-MD5)\.' -i ssl3/ok.txt); do host="${url##*/}"; (printf "GET / HTTP/1.1\r\nHost: $host\r\n\r\n";sleep .2) | openssl s_client -connect "$host" -CApath /etc/nginx/certs -no_tls1 -msg 2>&1 | awk '/Master-Key:/{key=$2} {b=1;e=16;if(l==3)b=7;if(l==1)e=6;for(i=b;i<=e;i++)s=s$i;if(l--==1)r[s]=1}/ ClientHello|ServerHello$/{l=3;s=""} END{for(rnd in r)print "CLIENT_RANDOM",rnd,key}'; done >> /tmp/snif/ssl3/premaster.txt
+
+# fetch a list of hosts to visit
+</etc/nginx/sites/ciphertest.conf awk -F '[:; ]+' '/listen/{port=$4}/server_name/&&$5{print "https://"$5":"port}' > urls.txt
+# Get good and bad cipher suites wrt web server certs
+rm ok.txt nok.txt;time while read url; do curl -ks "$url" -o /dev/null && echo $url >> ok.txt || echo $url >> nok.txt;done < urls.txt
+# same as above, but restrict to OpenSSL ciphers during request
+rm ok.txt nok.txt;time while read url; do cipher="${url%%.*}";cipher="${cipher##*/}";curl -ks "$url" -o /dev/null --ciphers "${cipher^^}" && echo $url >> ok.txt || echo $url >> nok.txt;done < urls.txt
+# same test, but using openssl instead of curl
+for url in $(cat res/ok.txt); do host="${url##*/}"; echo;echo;echo _____ $host;(printf "GET / HTTP/1.1\r\nHost: $host\r\n\r\n";sleep .2) | openssl s_client -connect "$host" -CApath /etc/nginx/certs; done 2>&1 | tee s_client-all-res-ok.txt
+
+# filter non-working ciphers (missing certs)
+grep -vE '^(PSK|SRP|DHE-DSS|ECDHE-ECDSA|ECDH)-'
+
+Non-working ciphers can be grouped into:
+- DHE-DSS, EDH-DSS, EXP-EDH-DSS
+- ECDHE-ECDSA
+
+Not supported by GnuTLS (source:
+http://backreference.org/2009/11/18/openssl-vs-gnutls-cipher-names/)
+- TLS-SRP (Secure Remote Password)
+- PSK (Pre-Shared Key)
+- ECDH-{RSA,ECDSA} (not ECDHE-RSA) (source: wikipedia)
+
+
+Missing support:
+- GCM
+0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
+0x00,0x9F DHE-RSA-AES256-GCM-SHA384
+0x00,0x9D AES256-GCM-SHA384
+0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
+0x00,0x9E DHE-RSA-AES128-GCM-SHA256
+0x00,0x9C AES128-GCM-SHA256
+- ECDHE-RSA
+0xC0,0x13 ECDHE-RSA-AES128-SHA
+0xC0,0x14 ECDHE-RSA-AES256-SHA
+0xC0,0x12 ECDHE-RSA-DES-CBC3-SHA
+
+(not tested: DSS)
+- cipher suites from `RFC 5246 - TLS 1.2` are verified with the script
+- cipher suites 150-155 are taken from: RFC 4162 - SEED for TLS
+- cipher suites 156-167 are taken from: RFC 5288 - AES-GCM Cipher suites
+- cipher suites 49153-49177 are taken from: RFC 4492 - ECC for TLS
+- cipher suites 49195-49202 are taken from RFC 5289 - ECC with
+ SHA256/384 and AES GCM
+
+
+# Generate dsa params, privkey and signed pubkey
+openssl dsaparam 1024 -out dsaparam.pem
+openssl gendsa dsaparam.pem -out dsa.pem
+openssl req -new -key dsa.pem -x509 -days 3650 -out dsa.crt -subj "/CN=*.local.al.lekensteyn.nl"
+# Generete EC params (secp112r1 cert does not work, "no shared cipher" error)
+# secp256r1 is supported by chromium (and secp{384,521}r1 too)
+openssl ecparam -name prime192v1 -out ec.pem -genkey
+openssl req -new -key ec.pem -x509 -days 3650 -out ec.crt -subj "/CN=*.local.al.lekensteyn.nl/OU=EC"
+
diff --git a/ssl3/ciphers-V-ssl3.txt b/ssl3/ciphers-V-ssl3.txt
new file mode 100644
index 0000000..a405871
--- /dev/null
+++ b/ssl3/ciphers-V-ssl3.txt
@@ -0,0 +1,39 @@
+ 0xC0,0x14 - ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
+ 0xC0,0x0A - ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
+ 0x00,0x39 - DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
+ 0x00,0x38 - DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1
+ 0x00,0x88 - DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
+ 0x00,0x87 - DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(256) Mac=SHA1
+ 0xC0,0x05 - ECDH-ECDSA-AES256-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256) Mac=SHA1
+ 0x00,0x35 - AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
+ 0x00,0x84 - CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1
+ 0xC0,0x12 - ECDHE-RSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=RSA Enc=3DES(168) Mac=SHA1
+ 0xC0,0x08 - ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=3DES(168) Mac=SHA1
+ 0x00,0x16 - EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1
+ 0x00,0x13 - EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1
+ 0xC0,0x03 - ECDH-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=3DES(168) Mac=SHA1
+ 0x00,0x0A - DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
+ 0xC0,0x13 - ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
+ 0xC0,0x09 - ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
+ 0x00,0x33 - DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
+ 0x00,0x32 - DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1
+ 0x00,0x9A - DHE-RSA-SEED-SHA SSLv3 Kx=DH Au=RSA Enc=SEED(128) Mac=SHA1
+ 0x00,0x99 - DHE-DSS-SEED-SHA SSLv3 Kx=DH Au=DSS Enc=SEED(128) Mac=SHA1
+ 0x00,0x45 - DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1
+ 0x00,0x44 - DHE-DSS-CAMELLIA128-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(128) Mac=SHA1
+ 0xC0,0x04 - ECDH-ECDSA-AES128-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(128) Mac=SHA1
+ 0x00,0x2F - AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
+ 0x00,0x96 - SEED-SHA SSLv3 Kx=RSA Au=RSA Enc=SEED(128) Mac=SHA1
+ 0x00,0x41 - CAMELLIA128-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA1
+ 0x00,0x07 - IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1
+ 0xC0,0x11 - ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1
+ 0xC0,0x07 - ECDHE-ECDSA-RC4-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=RC4(128) Mac=SHA1
+ 0xC0,0x02 - ECDH-ECDSA-RC4-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=RC4(128) Mac=SHA1
+ 0x00,0x05 - RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
+ 0x00,0x04 - RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
+ 0x00,0x15 - EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1
+ 0x00,0x12 - EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1
+ 0x00,0x09 - DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
+ 0x00,0x08 - EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
+ 0x00,0x06 - EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
+ 0x00,0x03 - EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
diff --git a/ssl3/debug.txt b/ssl3/debug.txt
new file mode 100644
index 0000000..bbe7829
--- /dev/null
+++ b/ssl3/debug.txt
@@ -0,0 +1,18073 @@
+Wireshark SSL debug log
+
+
+dissect_ssl enter frame #4 (first time)
+ssl_session_init: initializing ptr 0x7f265a927060 size 688
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 39639 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4434
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #6 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 1245
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236
+ record: offset = 1236, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245
+
+dissect_ssl enter frame #8 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 140
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 68, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929a...
+looking for RSA pre-master32acad72b858a286ba5fe24745258ef762da47719ed2ba27...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+key expansion[64]:
+| b3 a7 58 8e 43 4f 3e 0f 20 48 f5 6d 1f a7 18 98 |..X.CO>. H.m....|
+| 28 94 66 d6 e6 c8 b5 fc 82 60 49 6e 7b d0 19 bb |(.f......`In{...|
+| 48 67 9c 7d b3 58 6c dd 07 94 71 67 77 42 34 06 |Hg.}.Xl...qgwB4.|
+| 93 8b 7a 2c 11 59 c9 da 10 40 42 3d 21 78 ac c1 |..z,.Y...@B=!x..|
+ssl_generate_keyring_material MD5(client_random)
+ssl_generate_keyring_material MD5(server_random)
+Client MAC key[16]:
+| b3 a7 58 8e 43 4f 3e 0f 20 48 f5 6d 1f a7 18 98 |..X.CO>. H.m....|
+Server MAC key[16]:
+| 28 94 66 d6 e6 c8 b5 fc 82 60 49 6e 7b d0 19 bb |(.f......`In{...|
+Client Write key[16]:
+| 95 6b 28 90 bd 9f 9c bf 84 87 a5 8b f7 64 3d 3d |.k(..........d==|
+Server Write key[16]:
+| 83 bf 9a 95 db 76 ed 98 bf ee ca 14 45 c6 21 1b |.....v......E.!.|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| d0 62 76 03 00 00 00 00 |.bv..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 96 5d c5 5a e6 9e 9e 11 13 2c ab 48 f4 19 ab 80 |.].Z.....,.H....|
+| f9 7d 6c c8 c6 98 9e ae ff da 1d 57 d0 12 aa 25 |.}l........W...%|
+ssl_save_session stored master secret[48]:
+| 19 58 65 0f 35 74 79 29 55 54 da 62 f8 f3 0c 5f |.Xe.5ty)UT.b..._|
+| f9 38 d6 f8 30 7f 41 bf 90 1f 2a 94 fc 8a 03 f6 |.8..0.A...*.....|
+| d0 9e bb 32 ff 54 6b d6 3d a5 16 7a 01 9e 11 5e |...2.Tk.=..z...^|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 73, reported_length_remaining = 67
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 79, reported_length_remaining = 61
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 56, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 56
+Ciphertext[56]:
+| 3f d9 e7 46 b4 5f 14 c0 4a 35 b3 fe 6b 40 50 93 |?..F._..J5..k@P.|
+| fe d6 83 02 2f 4c e7 18 c5 63 b8 d6 17 de 36 5c |..../L...c....6\|
+| 8b c9 25 17 5d 98 0b 55 66 60 c2 9d 0c 03 76 5a |..%.]..Uf`....vZ|
+| 31 ab ba a9 b0 66 23 0d |1....f#. |
+ssl_decrypt_record: allocating 88 bytes for decrypt data (old len 32)
+Plaintext[56]:
+| 14 00 00 24 7f e5 b9 73 7f fd a6 1d 29 d6 96 33 |...$...s....)..3|
+| 37 30 5f 88 44 98 a6 30 db 32 fc 09 ac a8 01 e6 |70_.D..0.2......|
+| 36 67 1b ae a6 0d 7c 74 24 89 9b b8 04 4c 19 47 |6g....|t$....L.G|
+| d6 97 8d 3a 2c 7a 6b d6 |...:,zk. |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #9 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 67
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 61
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 56, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 56
+Ciphertext[56]:
+| e5 99 34 7d 47 5d c6 69 31 e2 94 3e 7f 83 75 17 |..4}G].i1..>..u.|
+| 0f 0a e2 11 ba a3 d5 1b 6d 40 71 fa 2a b1 d3 33 |........m@q.*..3|
+| d2 cb 17 01 b7 46 3a bb b4 10 26 d3 e6 81 51 7d |.....F:...&...Q}|
+| bc 13 cc b8 1d 9c 54 55 |......TU |
+Plaintext[56]:
+| 14 00 00 24 a4 33 9b 09 d7 af 08 c5 a2 04 c1 a0 |...$.3..........|
+| 4d a2 16 3c 61 5a be 24 64 e4 b4 62 ac b7 81 23 |M..<aZ.$d..b...#|
+| f6 9d db a6 4e e7 28 c5 fc 62 e7 8c 85 9c 7b ca |....N.(..b....{.|
+| b6 a1 3a 52 98 45 9b 2f |..:R.E./ |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #10 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 6a 67 7a 57 ca 70 4a c0 12 12 61 26 a6 e7 e5 b8 |jgzW.pJ...a&....|
+| d6 25 30 eb 3d ac 2c 5c 2c 5b 0f e2 9c cf 5e 1d |.%0.=.,\,[....^.|
+| ce 16 65 e9 b2 52 b8 22 d9 5f ac 78 a7 8b cd 27 |..e..R."._.x...'|
+| 99 3f 8b 68 8c a7 2f ed f2 58 1f 17 45 e2 46 17 |.?.h../..X..E.F.|
+| 13 a3 7a 58 b2 96 3f 3a 24 bf bb 2e 8c 58 5c 9d |..zX..?:$....X\.|
+| 2a |* |
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a 43 da c9 20 3e 35 ef 2c 19 9f 02 8b 30 07 9b |.C.. >5.,....0..|
+| 99 |. |
+checking mac (len 65, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65
+association_find: TCP port 39639 found (nil)
+association_find: TCP port 4434 found 0x3451b20
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x3451b20
+
+dissect_ssl enter frame #11 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 371, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 371
+Ciphertext[371]:
+| 7f bb 77 be 54 a3 47 11 fa 1b bc d6 d1 df 27 3f |..w.T.G.......'?|
+| 2f 52 89 bc 57 be 28 9c 26 9e f1 42 36 74 66 40 |/R..W.(.&..B6tf@|
+| a8 78 c3 7a 0a bb b0 0c fa 01 6d cc 54 f2 37 55 |.x.z......m.T.7U|
+| f5 6b 5d 95 a4 a5 90 fb 93 00 3a 20 ac 08 57 dd |.k].......: ..W.|
+| b5 51 3a e5 a2 f4 e0 b0 13 c2 f6 6f ff a3 33 e4 |.Q:........o..3.|
+| b2 88 43 7e cb 6a 55 75 7e 03 86 15 c1 d7 53 b7 |..C~.jUu~.....S.|
+| f4 d9 5f fe 10 9b 99 f5 12 e4 ff ab 18 19 9e ad |.._.............|
+| b1 6d 58 1d 07 44 36 43 e2 e7 25 a5 7b f9 f3 dd |.mX..D6C..%.{...|
+| e0 b1 ff 94 36 ed 4e 2c 14 4b eb 59 6d 4e 42 b9 |....6.N,.K.YmNB.|
+| 9f 58 3b 66 97 bd 02 23 c9 32 cf 2a 11 76 1a b8 |.X;f...#.2.*.v..|
+| 7b 68 9b 84 5f 47 e3 c9 89 92 fc 13 dc 66 8b 10 |{h.._G.......f..|
+| b3 82 3e 31 1b 9d 63 99 78 a0 8f 73 ac 41 9f 9a |..>1..c.x..s.A..|
+| e4 dc 94 ac ed 8c c9 be 44 db ec 1e 17 f2 0e ad |........D.......|
+| c1 7a 15 f3 63 a9 60 5d 8e 7c 89 d3 88 7e 75 03 |.z..c.`].|...~u.|
+| 5e 22 2b dc 3e 90 98 9c 93 4d 5f 17 63 da 50 35 |^"+.>....M_.c.P5|
+| cd 85 ef ef c0 e0 e9 13 3a 86 74 44 27 82 ad 3d |........:.tD'..=|
+| 2e 00 62 cf 66 39 19 9c 16 af ac 30 58 fb b8 a7 |..b.f9.....0X...|
+| be a3 91 1c 67 c2 d5 46 5e 2f 34 8d 7c c5 ae 77 |....g..F^/4.|..w|
+| 0d d8 e0 04 65 a6 cb 61 3c c7 09 38 44 a8 cd c6 |....e..a<..8D...|
+| 24 84 dc 17 2b bc 47 04 6c b7 75 50 b5 4e 22 1d |$...+.G.l.uP.N".|
+| b7 3e dd a4 93 4a ed 70 dc 55 3c f3 e2 2d 9c 10 |.>...J.p.U<..-..|
+| 29 91 df 8f 7f 85 de f0 14 35 23 b7 24 15 08 8c |)........5#.$...|
+| 31 9a 40 33 c4 e5 0f 59 34 bb 2c e3 f3 3b e4 43 |1.@3...Y4.,..;.C|
+| 18 d4 99 |... |
+ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 88)
+Plaintext[371]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e 6b 8b e7 df c2 91 2a 4a f9 40 44 9e a2 |pt>k.....*J.@D..|
+| 64 09 b3 |d.. |
+checking mac (len 355, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355
+association_find: TCP port 4434 found 0x3451b20
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x3451b20
+
+dissect_ssl enter frame #12 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 23 cb ce f3 3e 1c e5 9c a3 18 2e 8b b1 ea 4b 4d |#...>.........KM|
+| c4 0c |.. |
+Plaintext[18]:
+| 01 00 81 89 fa 2d f0 bb 30 50 c1 71 72 27 ec 87 |.....-..0P.qr'..|
+| 1f 02 |.. |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #14 (first time)
+ conversation = 0x7f2686942088, ssl_session = 0x7f265a927060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 18 39 1a 72 9e b6 e0 37 7d 2a d0 b5 44 7a 7f e1 |.9.r...7}*..Dz..|
+| b4 3b |.; |
+Plaintext[18]:
+| 01 00 12 6c 59 8b fa 9f 35 44 99 3f 9b f6 61 fe |...lY...5D.?..a.|
+| 77 a2 |w. |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #19 (first time)
+ssl_session_init: initializing ptr 0x7f265a929780 size 688
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 45669 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4435
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #21 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #23 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d296898...
+looking for RSA pre-master5164da4eaa7f53fad32c696ff088651f000dbf2d6d475100...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+key expansion[64]:
+| 09 5d 8b 39 7f d1 fd f3 14 74 19 f8 96 9e 8f 13 |.].9.....t......|
+| 4c 43 d6 ee 15 db 98 d7 29 6d 27 d9 30 d7 c0 49 |LC......)m'.0..I|
+| 5b 0c 43 48 52 88 3b fa a1 c0 d4 18 64 f1 4d c1 |[.CHR.;.....d.M.|
+| a0 45 26 fa 6c 9e b4 b9 c0 d7 a3 9d 23 35 86 98 |.E&.l.......#5..|
+Client MAC key[16]:
+| 09 5d 8b 39 7f d1 fd f3 14 74 19 f8 96 9e 8f 13 |.].9.....t......|
+Server MAC key[16]:
+| 4c 43 d6 ee 15 db 98 d7 29 6d 27 d9 30 d7 c0 49 |LC......)m'.0..I|
+Client Write key[16]:
+| 5b 0c 43 48 52 88 3b fa a1 c0 d4 18 64 f1 4d c1 |[.CHR.;.....d.M.|
+Server Write key[16]:
+| a0 45 26 fa 6c 9e b4 b9 c0 d7 a3 9d 23 35 86 98 |.E&.l.......#5..|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 80 96 74 03 00 00 00 00 |..t..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 6b 11 43 a3 f9 ef fc 65 f0 5b aa 1e 73 3d 8c 9c |k.C....e.[..s=..|
+| d6 93 c2 cd d7 d0 92 71 b7 60 38 72 c0 03 1f 9e |.......q.`8r....|
+ssl_save_session stored master secret[48]:
+| ad 12 09 32 5c 2a 53 0a ff ff 2e 3d 35 58 df ac |...2\*S....=5X..|
+| 5f 9d 4c fc de 96 91 87 1e f8 33 02 c2 75 8b e9 |_.L.......3..u..|
+| b5 f3 f6 bf 4b f9 f4 8e 01 65 99 ee 9b 3e 4a c1 |....K....e...>J.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 67
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 61
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 56, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 56
+Ciphertext[56]:
+| b7 98 d5 53 66 67 02 ec 31 44 23 f9 b1 d6 fb cc |...Sfg..1D#.....|
+| f4 28 0a 41 9e 78 85 a6 e6 e3 44 7a de a9 af c3 |.(.A.x....Dz....|
+| 01 63 57 b8 74 1c cd 5a ca 64 1e ee 86 7a 2f 2c |.cW.t..Z.d...z/,|
+| b0 74 bf 7f 80 24 62 b2 |.t...$b. |
+Plaintext[56]:
+| 14 00 00 24 45 88 9d 85 32 62 7e 62 d5 b2 9f a2 |...$E...2b~b....|
+| 2c 9f 81 ac ca 14 f7 44 ff fd 09 92 32 61 21 ab |,......D....2a!.|
+| b3 b4 2c 91 56 e5 d2 72 d9 c4 a1 3f 7f 82 81 dc |..,.V..r...?....|
+| 4d 0d f9 ee c3 42 e3 1a |M....B.. |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #24 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 67
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 61
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 56, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 56
+Ciphertext[56]:
+| 22 53 66 ff 10 32 6f a3 84 e5 86 37 80 54 f2 3f |"Sf..2o....7.T.?|
+| ec a2 ec 15 1c 89 eb c3 8b c3 f0 cc d2 73 9d aa |.............s..|
+| 24 ea 8a 8a b4 78 da 3d f6 b4 90 d0 c0 88 de 96 |$....x.=........|
+| 60 77 16 e3 01 41 49 46 |`w...AIF |
+Plaintext[56]:
+| 14 00 00 24 91 31 8e 11 5c ad fe d7 a2 88 85 26 |...$.1..\......&|
+| 32 01 65 25 ad 1b d1 8e 83 93 21 b0 f9 61 b6 1f |2.e%......!..a..|
+| 11 22 9f 81 fc ad 8d 6c e3 79 5b 9f 06 f6 e6 5f |.".....l.y[...._|
+| 45 f4 2b e3 5d 32 2e 38 |E.+.]2.8 |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #25 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 82
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 77, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 77
+Ciphertext[77]:
+| 1a 52 d4 2e 82 d6 e9 5c 4f 3b cb 11 ef d4 cb 90 |.R.....\O;......|
+| a5 03 6d ca 7d 0c 4a d3 71 7f 53 dd d3 8e 8b 6e |..m.}.J.q.S....n|
+| c8 a0 86 50 36 3f ff d5 41 a0 5a 20 e4 21 90 bd |...P6?..A.Z .!..|
+| 20 e1 0b f6 e3 0d 66 3c f9 76 d4 e3 dc 09 6c 57 | .....f<.v....lW|
+| 02 a6 4f f8 15 c9 07 d8 a8 d2 9d 28 22 |..O........(" |
+Plaintext[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a 81 d1 79 |n.nl:4435......y|
+| 8c 18 37 40 87 fc a0 57 ed 2b 27 a6 a4 |..7@...W.+'.. |
+checking mac (len 61, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 45669 found (nil)
+association_find: TCP port 4435 found 0x345a630
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... |
+dissect_ssl3_record found association 0x345a630
+
+dissect_ssl enter frame #26 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 368
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 363, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 363
+Ciphertext[363]:
+| d1 79 d8 90 f6 35 c2 1e 79 a4 3c c6 ec bc a2 58 |.y...5..y.<....X|
+| db 82 0d 0c d0 a3 da db b3 58 33 18 6f 87 ac 70 |.........X3.o..p|
+| 40 a7 83 f4 07 40 12 e3 68 85 7c 6d 3e 27 1c 43 |@....@..h.|m>'.C|
+| 95 a5 69 ff 37 b2 7c 81 98 a1 ed a9 b4 3d f7 74 |..i.7.|......=.t|
+| 24 2f 9c 93 75 97 2e 7a 16 ff bc 1e d1 34 de e9 |$/..u..z.....4..|
+| 8b 0e b8 6c b3 9c 8f a2 68 74 6b 35 39 b2 12 b2 |...l....htk59...|
+| e4 cb 94 61 71 9a 63 1b 9b 76 89 b2 ac 30 6f 0e |...aq.c..v...0o.|
+| d0 72 93 d3 3d 6c a2 c6 70 81 83 11 1c bd ba 88 |.r..=l..p.......|
+| 33 66 de 20 3b 70 7d 40 98 56 0d 15 44 f9 9c 96 |3f. ;p}@.V..D...|
+| b7 39 85 35 15 15 6d 90 43 8c 05 b4 63 a3 b7 08 |.9.5..m.C...c...|
+| 95 97 bb 0a fd 2f 50 da 15 e7 2f 32 0c 27 c1 1f |...../P.../2.'..|
+| 9d 51 08 b1 4a 81 22 bd 3c 1c 06 db c3 a7 55 63 |.Q..J.".<.....Uc|
+| 8c 2e d5 46 09 68 c0 83 ec e3 4e f6 cf 99 2c ae |...F.h....N...,.|
+| f0 f1 34 03 d8 ae 5e 45 02 9f e3 17 a1 68 4a 2b |..4...^E.....hJ+|
+| 15 36 7f bc eb be 60 a6 98 93 12 9a b7 d3 0c 34 |.6....`........4|
+| c2 f2 af e1 b2 5b b2 60 f9 6d db f6 08 4c fe 0c |.....[.`.m...L..|
+| c3 5c 85 8d db a1 df 06 33 71 1c 28 f9 43 f8 9d |.\......3q.(.C..|
+| 8d c6 41 5d 2e 1d d6 58 a3 58 93 67 71 29 07 1d |..A]...X.X.gq)..|
+| 33 cf 3b 21 fa 02 81 c3 89 e3 a6 48 5b 20 bd 2d |3.;!.......H[ .-|
+| bc f9 de d1 71 c3 ea 94 37 5f 6d cf ec 8b 29 8c |....q...7_m...).|
+| b0 1a 58 d1 f4 c0 08 97 0b ff 64 e4 07 aa a8 cb |..X.......d.....|
+| 86 0e bb 1a 4f 36 57 3e fd fc ba 16 bb 8b 61 41 |....O6W>......aA|
+| 4a 86 7c 5b b2 9e 7a b9 4e a5 19 |J.|[..z.N.. |
+Plaintext[363]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e c6 82 26 09 1a |l'</script>..&..|
+| e0 c0 6f 50 71 40 f7 da cf d0 e3 |..oPq@..... |
+checking mac (len 347, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347
+association_find: TCP port 4435 found 0x345a630
+dissect_ssl3_record decrypted len 347
+decrypted app data fragment[347]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e |l'</script> |
+dissect_ssl3_record found association 0x345a630
+
+dissect_ssl enter frame #27 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 2e 44 db b0 67 a5 91 5a 72 0d 87 b5 8e 35 35 ae |.D..g..Zr....55.|
+| 7e da |~. |
+Plaintext[18]:
+| 01 00 f6 4a 40 94 5d 82 9a c4 6f 6f eb a5 13 ef |...J@.]...oo....|
+| fc 82 |.. |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #29 (first time)
+ conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 41 ef 7b 34 1a 57 eb b1 b3 8a 2f 00 68 cb 7f 6f |A.{4.W..../.h..o|
+| 58 c7 |X. |
+Plaintext[18]:
+| 01 00 5f 64 10 77 15 4c 72 80 50 c3 e8 03 37 02 |.._d.w.Lr.P...7.|
+| 5e 7c |^| |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #34 (first time)
+ssl_session_init: initializing ptr 0x7f265a92bf40 size 688
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 52022 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4436
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #36 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #38 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 336
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e...
+looking for RSA pre-master82b9ec1045937e8c8d013b75ddaf13ecff77d1e03c377691...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| c8 60 96 dc dd d7 42 6f 2a 68 62 51 9c 50 80 5a |.`....Bo*hbQ.P.Z|
+| 31 61 17 67 3d e6 04 00 36 c8 65 e2 52 7a 70 af |1a.g=...6.e.Rzp.|
+| ca d1 7c ac fd dc 0c c7 8e b8 e2 55 42 38 a1 1c |..|........UB8..|
+| 7d 75 e1 f5 10 7c 05 bb 07 a3 22 fc 4c cc 2e 59 |}u...|....".L..Y|
+| d5 25 99 54 30 b1 f1 3f |.%.T0..? |
+Client MAC key[20]:
+| c8 60 96 dc dd d7 42 6f 2a 68 62 51 9c 50 80 5a |.`....Bo*hbQ.P.Z|
+| 31 61 17 67 |1a.g |
+Server MAC key[20]:
+| 3d e6 04 00 36 c8 65 e2 52 7a 70 af ca d1 7c ac |=...6.e.Rzp...|.|
+| fd dc 0c c7 |.... |
+Client Write key[16]:
+| 8e b8 e2 55 42 38 a1 1c 7d 75 e1 f5 10 7c 05 bb |...UB8..}u...|..|
+Server Write key[16]:
+| 07 a3 22 fc 4c cc 2e 59 d5 25 99 54 30 b1 f1 3f |..".L..Y.%.T0..?|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 63 76 03 00 00 00 00 | cv..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 8f 51 19 c8 9d 53 b9 3f 3c 2c 91 5d 46 87 2f ae |.Q...S.?<,.]F./.|
+| 21 99 9e 20 19 d4 c1 b3 b0 ff b5 a1 aa 8b 10 01 |!.. ............|
+ssl_save_session stored master secret[48]:
+| 07 0c 19 d8 fb d8 66 65 15 d0 a4 69 ee 51 d5 b2 |......fe...i.Q..|
+| 6e 4d fc 97 0a ef df 1b e6 06 1d 58 40 fa 5f 16 |nM.........X@._.|
+| 62 f3 4c 51 18 ec 27 05 08 5e dc d4 b0 fc cb b2 |b.LQ..'..^......|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| bd 17 35 d1 ca 73 df 0d b9 43 ff 83 47 df cc 20 |..5..s...C..G.. |
+| 42 bc 01 6c 9f 65 c7 2a db ea ab f5 f7 8e 6e 4a |B..l.e.*......nJ|
+| 0b 42 1a f0 7f 13 43 d0 77 c1 92 af 15 0f b4 1f |.B....C.w.......|
+| 5b 59 a7 ef 30 18 dd c4 a1 a1 21 95 |[Y..0.....!. |
+Plaintext[60]:
+| 14 00 00 24 ac 9c 1c 17 dd 68 cb 73 41 9b 5f 39 |...$.....h.sA._9|
+| 68 4d d2 a0 63 f1 53 85 e2 bd a5 75 06 c8 cf b1 |hM..c.S....u....|
+| 7b 1e c1 82 ea e3 f0 8a 85 14 66 d1 f1 f0 8a 73 |{.........f....s|
+| 21 c0 0e bf 5d 08 0a 24 86 a8 b4 ac |!...]..$.... |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #39 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| 8d d5 8d 2b 54 a4 e8 bb 39 e6 b0 a5 5d 29 5b 77 |...+T...9...])[w|
+| 69 68 9c fa 8f b9 db f6 85 1e 34 3b 2e 32 10 f4 |ih........4;.2..|
+| ca e3 c5 2b c8 ce e3 1a 6d a5 ad ea a3 e5 ad 87 |...+....m.......|
+| 29 d4 56 84 42 ca ad 00 5d 45 7b 2a |).V.B...]E{* |
+Plaintext[60]:
+| 14 00 00 24 8f b1 d3 42 41 0b 1f 2f 23 76 e6 a9 |...$...BA../#v..|
+| d1 94 a3 8e 67 13 81 37 db 69 5b 08 b8 fe 7b 0e |....g..7.i[...{.|
+| 52 e8 8a 47 53 c5 64 e3 e5 da 34 4b 40 5a 2e 87 |R..GS.d...4K@Z..|
+| de c0 1e c0 f6 cd ac 42 4c f6 39 52 |.......BL.9R |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #40 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 87 66 ab b1 99 e0 15 3e bf 52 75 23 5e 46 da eb |.f.....>.Ru#^F..|
+| 50 b9 b3 5a d2 20 17 86 da b0 8f fd 60 c4 ed 5b |P..Z. ......`..[|
+| 10 dd e5 2c 61 7f 92 6c c6 a9 4d b0 62 d1 f4 29 |...,a..l..M.b..)|
+| d2 88 69 c4 df 7b 64 28 48 fd fa 9c 0b 34 b8 cc |..i..{d(H....4..|
+| 88 47 f5 b5 9b d5 41 3a ce 40 fe bc e4 99 f8 0b |.G....A:.@......|
+| 17 |. |
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a 6d 17 a1 |n.nl:4436....m..|
+| 5e 66 d7 9c bd 67 df 19 46 13 07 fb b9 09 d3 1e |^f...g..F.......|
+| cd |. |
+checking mac (len 61, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 52022 found (nil)
+association_find: TCP port 4436 found 0x2e1c9d0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a |n.nl:4436.... |
+dissect_ssl3_record found association 0x2e1c9d0
+
+dissect_ssl enter frame #41 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| c9 4b e4 55 98 86 b7 58 28 b8 a1 22 53 33 20 66 |.K.U...X(.."S3 f|
+| 74 43 ac ae a0 21 22 56 ec c8 61 09 24 9d ff be |tC...!"V..a.$...|
+| e3 16 1a 31 6d 11 e0 f5 51 cf 52 dd de fe ad 78 |...1m...Q.R....x|
+| 11 cb 18 29 06 04 c3 b0 cb b5 0b 7b ad 60 aa ae |...).......{.`..|
+| ad 9e 80 e0 dc d6 60 75 24 99 4c 12 95 87 b7 71 |......`u$.L....q|
+| 58 d0 03 02 2b d2 d0 0f 5e b1 0b 4a be 12 b5 2a |X...+...^..J...*|
+| 0c 53 03 1e de 00 d8 d2 7e b0 5f 3f 85 74 76 90 |.S......~._?.tv.|
+| 82 64 9d e1 2f 03 97 78 c2 70 4b c9 07 91 e9 82 |.d../..x.pK.....|
+| be 8a 7c 9d 1b 63 f4 7b c2 60 a0 de 76 88 68 18 |..|..c.{.`..v.h.|
+| c8 93 20 ab a1 d2 d7 a3 6c f3 a6 80 56 78 d3 13 |.. .....l...Vx..|
+| d9 9a d8 94 a7 97 6a 0f 60 7b 96 70 93 67 9b b8 |......j.`{.p.g..|
+| 01 8b 73 86 b5 16 f5 f4 18 72 e9 7f 5c ad c4 eb |..s......r..\...|
+| e8 da dd 25 4a f3 1b 96 b7 08 95 4a 30 61 03 3c |...%J......J0a.<|
+| 94 2c 6e 8d fc 29 39 c7 58 41 4b 1f d3 ae e2 f9 |.,n..)9.XAK.....|
+| f8 83 40 7e 56 0e 85 7a e3 f5 67 74 36 15 bd 6d |..@~V..z..gt6..m|
+| ed 88 d3 ff 77 24 51 f6 19 3d ae b1 8d 60 ae 6b |....w$Q..=...`.k|
+| 5a 10 25 40 1d 71 46 98 78 11 0a 06 8d 5b f1 b3 |Z.%@.qF.x....[..|
+| 63 87 e4 27 37 6b 45 b8 e5 68 22 49 82 05 08 4b |c..'7kE..h"I...K|
+| f6 7c 60 89 5f 60 27 2d 21 f3 53 a1 3b 9e 2d 83 |.|`._`'-!.S.;.-.|
+| bd 12 3a ca 10 3b 9e 54 3a 38 a8 e0 c1 57 57 0b |..:..;.T:8...WW.|
+| 5e e7 08 71 de a7 50 4c 88 4e e8 a3 12 e4 e2 36 |^..q..PL.N.....6|
+| 56 3e ca 8e 10 8e 0d e1 eb 51 d5 35 75 de ea dc |V>.......Q.5u...|
+| 5c a7 4b 8d 3f 37 62 a3 26 19 e2 7e 4b 57 3c 4e |\.K.?7b.&..~KW<N|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e b2 31 fd d4 |nl'</script>.1..|
+| 79 e3 65 b3 0d 12 0a d2 97 4e 49 cf d0 c1 19 89 |y.e......NI.....|
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4436 found 0x2e1c9d0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x2e1c9d0
+
+dissect_ssl enter frame #42 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 3a ab cf 51 14 d9 48 f8 e5 ae 22 7c 71 0b d3 1b |:..Q..H..."|q...|
+| dd 97 ca f2 2d 66 |....-f |
+Plaintext[22]:
+| 01 00 49 b6 07 ea 09 cb e5 15 d0 19 b3 85 74 e1 |..I...........t.|
+| 6d d9 7a 5f 88 4c |m.z_.L |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #44 (first time)
+ conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 3e bd 51 1e 6c f2 78 69 2d 7f 2d ef 29 03 5d 2e |>.Q.l.xi-.-.).].|
+| 17 d7 c7 31 8f a5 |...1.. |
+Plaintext[22]:
+| 01 00 79 d5 af 46 2c 4b 33 ed 17 48 4f 1a 6d 84 |..y..F,K3..HO.m.|
+| 89 62 15 61 90 c5 |.b.a.. |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #49 (first time)
+ssl_session_init: initializing ptr 0x7f265a92e700 size 688
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 42500 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4437
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #51 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 1245
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236
+ record: offset = 1236, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245
+
+dissect_ssl enter frame #53 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 148
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 68, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60e...
+looking for RSA pre-master3487889b063f97654522ee8e3f44dc641071cfc4cd344af9...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+key expansion[88]:
+| 62 91 2f d8 a2 90 ee b8 20 a7 6a ce 01 6e ce e0 |b./..... .j..n..|
+| 35 ff c1 6e 96 6e 73 38 0c ca c1 a5 d5 ec 81 13 |5..n.ns8........|
+| 13 b3 f0 6b 89 3d 04 a6 b1 03 c2 07 9f 77 18 9f |...k.=.......w..|
+| 25 a8 e0 86 7b b2 f1 1c c3 32 69 a7 10 84 58 0b |%...{....2i...X.|
+| 78 a5 ce 0e 6d 5b c4 ab 6e a8 90 de 9d 00 71 60 |x...m[..n.....q`|
+| 18 09 f5 2f de 36 5a 6e |.../.6Zn |
+ssl_generate_keyring_material ssl3_generate_export_iv
+export iv[8]:
+| 1e de d3 51 14 95 52 21 |...Q..R! |
+ssl_generate_keyring_material ssl3_generate_export_iv(2)
+export iv[8]:
+| cb 87 2b a2 bb a1 e6 a2 |..+..... |
+ssl_generate_keyring_material MD5(client_random)
+ssl_generate_keyring_material MD5(server_random)
+Client MAC key[20]:
+| 62 91 2f d8 a2 90 ee b8 20 a7 6a ce 01 6e ce e0 |b./..... .j..n..|
+| 35 ff c1 6e |5..n |
+Server MAC key[20]:
+| 96 6e 73 38 0c ca c1 a5 d5 ec 81 13 13 b3 f0 6b |.ns8...........k|
+| 89 3d 04 a6 |.=.. |
+Client Write key[16]:
+| 40 8b c6 91 5b d5 20 4d 45 fb 73 db a5 04 77 d3 |@...[. ME.s...w.|
+Server Write key[16]:
+| 95 fc fb 62 7d 8b 08 50 3c 1a 19 32 dd 80 e6 ae |...b}..P<..2....|
+Client Write IV[8]:
+| 1e de d3 51 14 95 52 21 |...Q..R! |
+Server Write IV[8]:
+| cb 87 2b a2 bb a1 e6 a2 |..+..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_handshake can't generate keyring material
+ record: offset = 73, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 79, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 220 offset 84 length 3050327 bytes, remaining 148
+
+dissect_ssl enter frame #54 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 243 offset 11 length 9422513 bytes, remaining 75
+
+dissect_ssl enter frame #55 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 42500 found (nil)
+association_find: TCP port 4437 found 0x221ac20
+ record: offset = 29, reported_length_remaining = 93
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 88, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 42500 found (nil)
+association_find: TCP port 4437 found 0x221ac20
+
+dissect_ssl enter frame #56 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 4437 found 0x221ac20
+
+dissect_ssl enter frame #57 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #59 (first time)
+ conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #64 (first time)
+ssl_session_init: initializing ptr 0x7f265a9304d0 size 688
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 52578 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4438
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #66 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #68 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd...
+looking for RSA pre-master3020985a5736aab08d91165d975e4db8e638402b794e782c...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+key expansion[88]:
+| 74 b3 17 5c 58 09 22 fe 45 1f 7d 58 85 df de 0a |t..\X.".E.}X....|
+| 4d da f9 40 17 15 4e 87 9e 2e 17 c9 1c b0 d1 c4 |M..@..N.........|
+| 18 28 40 f8 f3 2c 43 8a a7 a9 14 b8 9b 5b b1 42 |.(@..,C......[.B|
+| 42 34 68 f3 30 9b 27 7f cd 6b d3 0f c6 f5 00 41 |B4h.0.'..k.....A|
+| 09 66 45 0c 7e 0f 55 35 c1 b4 b3 18 86 2e 44 fc |.fE.~.U5......D.|
+| 1f 75 5b 27 64 fd 9e 22 |.u['d.." |
+Client MAC key[20]:
+| 74 b3 17 5c 58 09 22 fe 45 1f 7d 58 85 df de 0a |t..\X.".E.}X....|
+| 4d da f9 40 |M..@ |
+Server MAC key[20]:
+| 17 15 4e 87 9e 2e 17 c9 1c b0 d1 c4 18 28 40 f8 |..N..........(@.|
+| f3 2c 43 8a |.,C. |
+Client Write key[16]:
+| a7 a9 14 b8 9b 5b b1 42 42 34 68 f3 30 9b 27 7f |.....[.BB4h.0.'.|
+Server Write key[16]:
+| cd 6b d3 0f c6 f5 00 41 09 66 45 0c 7e 0f 55 35 |.k.....A.fE.~.U5|
+Client Write IV[8]:
+| c1 b4 b3 18 86 2e 44 fc |......D. |
+Server Write IV[8]:
+| 1f 75 5b 27 64 fd 9e 22 |.u['d.." |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| f7 28 87 a1 70 bf f5 f9 2d 54 92 95 7a ab 17 99 |.(..p...-T..z...|
+| ca 3a fa e5 eb b5 c5 8f 67 74 2b fb 9a 4f 7c fd |.:......gt+..O|.|
+ssl_save_session stored master secret[48]:
+| 0c 9d a0 33 b5 2c 5b 8e 8a f8 56 e8 e4 00 cb 4d |...3.,[...V....M|
+| b6 d0 56 78 f5 91 3b f0 f4 6b 2a ff 90 25 f6 96 |..Vx..;..k*..%..|
+| 8e 5e a3 07 23 12 b9 d1 2d 34 84 ab 56 07 ae 0e |.^..#...-4..V...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 98 aa 29 b5 e3 c5 59 a7 2b 43 28 f5 71 5a c1 bf |..)...Y.+C(.qZ..|
+| 5a 00 da a6 f6 0c 8e 75 e5 7d 83 fc 9f bd 6d ca |Z......u.}....m.|
+| 83 62 ed 49 67 ae 04 c6 53 23 7d c6 3f 5d bb 9b |.b.Ig...S#}.?]..|
+| c9 76 2b 16 35 0c a1 ab 19 8a b9 77 a3 4a eb 5f |.v+.5......w.J._|
+Plaintext[64]:
+| 14 00 00 24 b1 a2 de a3 32 0a 4d f6 41 48 e2 dc |...$....2.M.AH..|
+| 40 2d 64 45 5a db 5e 5a eb 20 76 28 dc d2 67 94 |@-dEZ.^Z. v(..g.|
+| 15 b6 33 73 6c 36 e6 69 92 50 43 22 61 07 b0 de |..3sl6.i.PC"a...|
+| e2 68 0a 65 b1 3f 5b 0e 1a c7 11 e9 00 00 00 03 |.h.e.?[.........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #69 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 88 f0 18 86 d2 9d 20 36 cd 4e b4 a6 7d 27 62 bc |...... 6.N..}'b.|
+| fe c7 57 84 8f 4b 36 51 3e 48 26 da fe 23 74 c5 |..W..K6Q>H&..#t.|
+| 63 a7 e6 70 3a ec 2a 6f 21 cc 72 f2 e9 56 f8 f3 |c..p:.*o!.r..V..|
+| 40 2c 31 1b 63 05 f2 db 08 37 db 51 e2 4f f1 57 |@,1.c....7.Q.O.W|
+Plaintext[64]:
+| 14 00 00 24 fa 12 13 49 21 1d e1 82 d2 58 71 c7 |...$...I!....Xq.|
+| 54 8c 3c 40 d5 df fb 6e 61 b5 7c 68 d4 58 68 13 |T.<@...na.|h.Xh.|
+| 2a 27 fd 87 02 bd 65 5c 3f f3 cd c6 67 98 1b ef |*'....e\?...g...|
+| 3c 18 f4 e0 02 4e 7f f0 ee 2b a8 b0 00 00 00 03 |<....N...+......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #70 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 1f a7 54 1e 3a 5f 56 ff ee 8b ed b3 c7 1d 12 a0 |..T.:_V.........|
+| 70 ad fd 06 ea 3c c6 d7 |p....<.. |
+Plaintext[24]:
+| f3 12 91 9c 24 92 3e a9 a9 43 43 fe e5 08 d9 4b |....$.>..CC....K|
+| 79 cc 70 dd 00 00 00 03 |y.p..... |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 52578 found (nil)
+association_find: TCP port 4438 found 0x3451d20
+ record: offset = 29, reported_length_remaining = 93
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 88, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 88
+Ciphertext[88]:
+| 14 56 7f 6c e5 8e e5 f5 b1 64 5d 45 96 79 6f 01 |.V.l.....d]E.yo.|
+| 18 3f fd dc 82 e3 e0 6c 78 27 f0 0f 2a 7b e5 3f |.?.....lx'..*{.?|
+| 95 11 c6 29 ea f9 6a 83 7c 35 1a 85 80 00 47 cc |...)..j.|5....G.|
+| f1 bc 32 e0 c7 32 f0 61 08 fc 59 b3 f7 93 25 78 |..2..2.a..Y...%x|
+| ec 52 35 0c f2 98 f1 4f d2 c4 5f b5 c2 3b 69 4a |.R5....O.._..;iJ|
+| e5 f8 42 9a c3 86 c0 ae |..B..... |
+Plaintext[88]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 69 64 65 61 2d 63 62 63 2d 73 |Host: idea-cbc-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 38 0d 0a |nsteyn.nl:4438..|
+| 0d 0a d7 28 32 7c 58 f3 8e 32 0b 20 ec 94 1a e9 |...(2|X..2. ....|
+| ca 1a fe 09 79 f0 00 01 |....y... |
+ssl_decrypt_record found padding 1 final len 86
+checking mac (len 66, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 66, seq = 0, nxtseq = 66
+association_find: TCP port 52578 found (nil)
+association_find: TCP port 4438 found 0x3451d20
+dissect_ssl3_record decrypted len 66
+decrypted app data fragment[66]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 69 64 65 61 2d 63 62 63 2d 73 |Host: idea-cbc-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 38 0d 0a |nsteyn.nl:4438..|
+| 0d 0a |.. |
+dissect_ssl3_record found association 0x3451d20
+
+dissect_ssl enter frame #71 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| 5d 68 31 66 d8 32 8c b1 6d 06 74 36 d2 40 9f 8c |]h1f.2..m.t6.@..|
+| 38 20 a3 64 c4 13 74 aa 03 a9 07 da 45 61 49 7a |8 .d..t.....EaIz|
+| 8d cc e4 cb e7 c1 78 0a f4 db dd 66 94 85 a4 2a |......x....f...*|
+| da 37 06 04 d1 b2 38 6f 93 ad a9 d2 85 8a c3 87 |.7....8o........|
+| d0 25 60 9c 14 30 12 88 54 9a 0f a4 a8 67 f9 fc |.%`..0..T....g..|
+| 58 70 d3 14 e1 4d 50 ca e0 3d f2 0c be 42 ab e7 |Xp...MP..=...B..|
+| 37 44 3f 4d 48 e9 a7 9c 1b 8b 42 47 d1 b2 9f d5 |7D?MH.....BG....|
+| 92 c6 7c 59 89 ba 74 c0 af 9f 19 4c ad c1 be da |..|Y..t....L....|
+| da 37 32 46 95 73 33 9a 2d 52 34 60 1f 7c 5e fa |.72F.s3.-R4`.|^.|
+| 84 05 ef c5 0d 6f 4a df 0f 6e 54 d9 8a 03 0b 42 |.....oJ..nT....B|
+| ba 59 bc c9 51 dd 24 6b 5c f6 b6 58 ce 75 98 6e |.Y..Q.$k\..X.u.n|
+| 18 e7 c3 da 34 5b ea a5 c1 a7 fa e1 e6 ca 3d bf |....4[........=.|
+| 37 8a 55 7d 90 0c d8 aa 15 6a 2e 3b f3 03 13 70 |7.U}.....j.;...p|
+| 82 6b 5e f6 cd da f5 65 b7 6b df bd f8 78 0b 83 |.k^....e.k...x..|
+| de 9d 93 24 b0 9d 98 73 33 99 0b 9a ed cc 34 f4 |...$...s3.....4.|
+| 59 82 34 b8 03 4e a7 b9 f0 2b d6 00 76 0d 98 96 |Y.4..N...+..v...|
+| 43 e8 9a 50 fc 9a bf 6e 74 cd 1f a1 33 cf ee 15 |C..P...nt...3...|
+| 55 8f e4 ce 39 68 92 bf e1 de c8 05 62 5d cb 72 |U...9h......b].r|
+| b9 5f 74 cd e0 9e 0a bc e0 e3 7b 81 0d ea 66 5b |._t.......{...f[|
+| 64 0a 95 29 84 e3 92 f6 b6 26 aa e0 72 51 7f bc |d..).....&..rQ..|
+| 96 8b 67 59 d1 11 3d 03 86 19 06 3d de 8a a5 6d |..gY..=....=...m|
+| 33 a8 23 92 c7 90 f6 c7 fd 4a 79 0f a5 da 0a 5d |3.#......Jy....]|
+| 1f c7 e6 40 9e 4a 93 a2 2c 15 12 e3 44 a0 6b 33 |...@.J..,...D.k3|
+| d9 c6 0e 0e b9 33 5b 28 |.....3[( |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 37 20 2d 20 49 44 45 41 2d |x00,0x07 - IDEA-|
+| 43 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 |CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 49 44 45 41 28 31 32 38 29 20 4d 61 63 3d 53 |=IDEA(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ed 3f 99 98 |nl'</script>.?..|
+| c0 02 18 b7 9b 84 35 6b 95 83 2a 1a a3 23 5b 23 |......5k..*..#[#|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4438 found 0x3451d20
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 37 20 2d 20 49 44 45 41 2d |x00,0x07 - IDEA-|
+| 43 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 |CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 49 44 45 41 28 31 32 38 29 20 4d 61 63 3d 53 |=IDEA(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3451d20
+
+dissect_ssl enter frame #72 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| bf 22 e6 0b 32 76 e3 94 8c b9 b9 5d 68 c8 74 04 |."..2v.....]h.t.|
+| 8a cf e1 42 5f e4 cd e9 |...B_... |
+Plaintext[24]:
+| 01 00 fe 61 08 2e d6 04 3a 0c f7 0a a0 77 da 26 |...a....:....w.&|
+| 11 43 43 1d 9b cc 00 01 |.CC..... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #74 (first time)
+ conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 8c c5 ca dd 8b 4a 25 2d 81 7e 90 14 e2 35 23 3c |.....J%-.~...5#<|
+| f9 87 dd 69 95 9c cd c3 |...i.... |
+Plaintext[24]:
+| 01 00 65 cb 63 c4 81 95 7b 1c d8 b4 38 57 70 19 |..e.c...{...8Wp.|
+| 83 1b 99 d3 ce ea 00 01 |........ |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #79 (first time)
+ssl_session_init: initializing ptr 0x7f265a932d30 size 688
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 51639 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4439
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #81 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 1245
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236
+ record: offset = 1236, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245
+
+dissect_ssl enter frame #83 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 148
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 68, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef79...
+looking for RSA pre-master7923a2cab3257ae850d71ffcb09c8b3286134e61dd14976a...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| 8c ea ea bb 9e 2d 1d 3c b7 47 2a 30 a3 7e 34 da |.....-.<.G*0.~4.|
+| 5b 61 79 5b af 73 49 f4 7a e8 e4 f5 9a aa 7b 35 |[ay[.sI.z.....{5|
+| 17 2b 80 58 f6 de 06 41 43 f7 bb aa ea bf bf 82 |.+.X...AC.......|
+| ea a4 d6 20 18 c1 32 9c 02 98 0c 29 6c f7 43 36 |... ..2....)l.C6|
+| ee 24 57 21 75 b8 8f be |.$W!u... |
+ssl_generate_keyring_material ssl3_generate_export_iv
+export iv[8]:
+| 99 9f 26 3d 26 c3 f9 95 |..&=&... |
+ssl_generate_keyring_material ssl3_generate_export_iv(2)
+export iv[8]:
+| f9 d1 4b a7 4e 91 6f 30 |..K.N.o0 |
+ssl_generate_keyring_material MD5(client_random)
+ssl_generate_keyring_material MD5(server_random)
+Client MAC key[20]:
+| 8c ea ea bb 9e 2d 1d 3c b7 47 2a 30 a3 7e 34 da |.....-.<.G*0.~4.|
+| 5b 61 79 5b |[ay[ |
+Server MAC key[20]:
+| af 73 49 f4 7a e8 e4 f5 9a aa 7b 35 17 2b 80 58 |.sI.z.....{5.+.X|
+| f6 de 06 41 |...A |
+Client Write key[8]:
+| be 18 2d 3c 17 35 9f f8 |..-<.5.. |
+Server Write key[8]:
+| b2 33 4b 9f 94 e4 86 4d |.3K....M |
+Client Write IV[8]:
+| 99 9f 26 3d 26 c3 f9 95 |..&=&... |
+Server Write IV[8]:
+| f9 d1 4b a7 4e 91 6f 30 |..K.N.o0 |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 67 cd 75 c5 ce 3a e6 d3 48 ec 14 98 a9 69 05 ee |g.u..:..H....i..|
+| 92 bf 1d bf 2b 2c 3f 48 51 0d 31 d7 09 99 2a 70 |....+,?HQ.1...*p|
+ssl_save_session stored master secret[48]:
+| ca fa 4d 43 12 80 91 20 7f 8e b6 f2 f0 f8 01 cd |..MC... ........|
+| bf 1e 4c d8 34 da 0a eb af 23 66 36 9e f1 fc f8 |..L.4....#f6....|
+| 3f 81 cf 77 05 53 ec 15 b1 09 67 d9 3a 92 84 e8 |?..w.S....g.:...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 73, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 79, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| e5 42 33 96 fc 98 1b bb 5e be 87 0c 09 d4 80 55 |.B3.....^......U|
+| 98 8f f0 f5 12 88 d3 45 42 2b dc c8 a2 60 c9 aa |.......EB+...`..|
+| 81 d3 a2 66 43 d3 90 e1 bb d9 fe d7 3f 1c f1 68 |...fC.......?..h|
+| fc b0 b1 2b 76 2f e6 8d 62 f4 7c 1d 07 f5 f5 e1 |...+v/..b.|.....|
+Plaintext[64]:
+| 14 00 00 24 32 2e 70 30 7a 42 8d d4 93 ee 91 ac |...$2.p0zB......|
+| 06 c9 1f 31 76 de 2a 1c 35 9f 7b d6 51 7c 69 6a |...1v.*.5.{.Q|ij|
+| e6 43 78 ef 75 35 8c 01 33 26 e9 03 6a 27 71 3d |.Cx.u5..3&..j'q=|
+| 45 a9 6d f3 25 d4 41 16 1c e2 cf 88 00 00 00 03 |E.m.%.A.........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #84 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| aa c5 79 3b d4 dc 59 ab 43 db f0 e3 3a 45 0f e4 |..y;..Y.C...:E..|
+| 21 46 b5 83 76 d1 8d e9 89 f7 06 45 1a 54 22 5a |!F..v......E.T"Z|
+| f7 58 44 5b 51 f4 e0 8d 3a 5b c5 b7 5f c3 38 0d |.XD[Q...:[.._.8.|
+| f3 94 73 2c 52 d6 f5 b2 f5 94 e1 87 a0 90 d7 2c |..s,R..........,|
+Plaintext[64]:
+| 14 00 00 24 a6 56 5b bf be 0c a4 6e 54 13 82 90 |...$.V[....nT...|
+| 7b 4e 92 f0 1b b7 48 e3 38 35 9a 57 cc 49 ae 51 |{N....H.85.W.I.Q|
+| 72 b7 4a 41 6b da ae 14 59 2b cb 2d 20 f7 71 c0 |r.JAk...Y+.- .q.|
+| 07 20 3e 94 fb 8d d9 14 44 49 0e 84 00 00 00 03 |. >.....DI......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #85 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 130
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| ad 23 e4 39 6a 30 3b 73 30 3e ec 1d 48 a7 79 d9 |.#.9j0;s0>..H.y.|
+| 70 fd d4 bd aa b8 51 68 |p.....Qh |
+Plaintext[24]:
+| 13 60 5c c9 bb 4e 48 32 0e 17 7d ab 61 2e 7d 69 |.`\..NH2..}.a.}i|
+| eb 66 a7 53 00 00 00 03 |.f.S.... |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 51639 found (nil)
+association_find: TCP port 4439 found 0x345a120
+ record: offset = 29, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 58 d4 53 35 6f 8f 5f 83 37 b9 c2 a1 26 e0 e0 a6 |X.S5o._.7...&...|
+| 3b 00 8b c6 cc 7a 2e 4b b8 8c 9e 13 4c 1b f5 00 |;....z.K....L...|
+| 0c 75 81 90 71 bd 96 5c a3 fd 00 fc 37 fb 6e da |.u..q..\....7.n.|
+| 55 b7 a6 67 f0 d8 6a b8 8f 21 3f 33 c5 f0 97 fd |U..g..j..!?3....|
+| ec 12 16 38 0b 7d b9 66 28 30 d5 ee 22 2e 53 64 |...8.}.f(0..".Sd|
+| b8 a8 bb d5 ca 4a 43 ab 6f 4a 7a aa d8 ac 30 ff |.....JC.oJz...0.|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 64 65 73 2d 63 62 |Host: exp-des-cb|
+| 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |c-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 |ekensteyn.nl:443|
+| 39 0d 0a 0d 0a fb b9 56 27 96 dc 16 74 81 21 cf |9......V'...t.!.|
+| 4d f1 2e 4a dd 52 54 69 13 00 00 00 00 00 00 06 |M..J.RTi........|
+ssl_decrypt_record found padding 6 final len 89
+checking mac (len 69, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 69, seq = 0, nxtseq = 69
+association_find: TCP port 51639 found (nil)
+association_find: TCP port 4439 found 0x345a120
+dissect_ssl3_record decrypted len 69
+decrypted app data fragment[69]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 64 65 73 2d 63 62 |Host: exp-des-cb|
+| 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |c-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 |ekensteyn.nl:443|
+| 39 0d 0a 0d 0a |9.... |
+dissect_ssl3_record found association 0x345a120
+
+dissect_ssl enter frame #86 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| 95 43 6f c9 5b 8f 17 f6 64 a8 ff 5f 5a 5c d0 24 |.Co.[...d.._Z\.$|
+| b8 d6 7a 51 95 10 6b bd 16 9b d0 36 91 b1 72 f5 |..zQ..k....6..r.|
+| be 28 63 cf cd 13 ba 39 97 5d a2 6a 92 e4 8b 9d |.(c....9.].j....|
+| 3e 93 1d 0b d9 5f 17 7b f0 53 f7 86 6a b1 82 35 |>...._.{.S..j..5|
+| 37 be 95 64 de 91 9e a0 93 5c 81 08 c5 9c e4 e8 |7..d.....\......|
+| 4c 2d 55 18 58 96 60 49 db 76 78 b3 99 e3 16 fb |L-U.X.`I.vx.....|
+| 72 8b c8 18 0b 49 ab 80 8d ed 8e f2 45 db dd 21 |r....I......E..!|
+| 7d ea 04 4a f9 ba ac 47 f1 ef b1 88 35 4e 76 9d |}..J...G....5Nv.|
+| 79 e8 4e c8 ee d8 69 03 d3 c5 64 5e 1b bb 1f 89 |y.N...i...d^....|
+| e9 56 26 55 5c 43 0e 7b a2 e0 ba ae cc b5 8e b6 |.V&U\C.{........|
+| 4d 5a 1a 4a c9 d9 19 e4 82 6e c2 26 76 80 24 37 |MZ.J.....n.&v.$7|
+| 80 c1 f0 26 7c 79 f1 47 42 81 7a 48 8d a3 cf 39 |...&|y.GB.zH...9|
+| 02 0c c9 ee 6b d3 33 2a 16 15 17 dd 0d 7f b0 08 |....k.3*........|
+| 1a e0 a6 19 46 14 73 46 5e 84 3c 70 3c 8e 5f 71 |....F.sF^.<p<._q|
+| e1 18 06 46 78 53 34 b6 e1 64 f8 b2 35 17 e3 e6 |...FxS4..d..5...|
+| 41 69 99 a4 23 ed 50 24 8c 49 8f d8 7c 0f 4a b6 |Ai..#.P$.I..|.J.|
+| 67 f2 de e6 6d 6e f2 58 7a ef 67 ab 0c 62 d1 f8 |g...mn.Xz.g..b..|
+| be 76 08 3f f7 da ec d4 74 a0 db eb 53 48 e2 08 |.v.?....t...SH..|
+| 16 55 8c 4c 78 7f 2b a4 e7 49 30 d3 4f a3 4f 08 |.U.Lx.+..I0.O.O.|
+| 8d 9b b3 2c b7 64 53 e5 ac 5c db 92 1c 80 fa 3a |...,.dS..\.....:|
+| 05 45 f6 a7 8a ca 65 35 87 ef 3b 14 cf 31 5d ca |.E....e5..;..1].|
+| 83 fd cb f6 56 92 ae c1 e2 cb fb 4b 4a 7a 82 81 |....V......KJz..|
+| 53 00 e2 8d 03 4d ec c6 27 08 e8 46 7b 08 3c 37 |S....M..'..F{.<7|
+| 5b 1e 4f 7f be 2f be 46 |[.O../.F |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 38 20 2d 20 45 58 50 2d 44 |x00,0x08 - EXP-D|
+| 45 53 2d 43 42 43 2d 53 48 41 20 20 20 20 20 20 |ES-CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 44 45 53 28 34 30 29 20 20 20 4d 61 63 3d 53 |=DES(40) Mac=S|
+| 48 41 31 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |HA1 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e b4 58 c5 b5 4d 99 a6 4b c8 96 b2 b3 ed |pt>.X..M..K.....|
+| 34 9b cc 13 7d 50 e2 00 |4...}P.. |
+ssl_decrypt_record found padding 0 final len 375
+checking mac (len 355, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355
+association_find: TCP port 4439 found 0x345a120
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 38 20 2d 20 45 58 50 2d 44 |x00,0x08 - EXP-D|
+| 45 53 2d 43 42 43 2d 53 48 41 20 20 20 20 20 20 |ES-CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 44 45 53 28 34 30 29 20 20 20 4d 61 63 3d 53 |=DES(40) Mac=S|
+| 48 41 31 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |HA1 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x345a120
+
+dissect_ssl enter frame #87 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| ac ef 10 0f 4c 29 74 45 8e 6a bb df 7d 12 58 de |....L)tE.j..}.X.|
+| 95 8b 1a eb 2c 10 d4 7f |....,... |
+Plaintext[24]:
+| 01 00 42 87 e1 00 aa 95 b5 1f ae 67 f9 0f 8a eb |..B........g....|
+| d1 2e 61 aa 52 63 00 01 |..a.Rc.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #89 (first time)
+ conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 9b c5 23 07 78 9c 15 d0 16 f2 2b 49 6d 75 5c 4f |..#.x.....+Imu\O|
+| 42 db 6e 26 99 94 83 8c |B.n&.... |
+Plaintext[24]:
+| 01 00 fe 92 71 97 73 46 a5 d5 d4 f0 1f 38 80 d6 |....q.sF.....8..|
+| 74 13 e9 5f 11 ce 00 01 |t.._.... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #94 (first time)
+ssl_session_init: initializing ptr 0x7f265a9354e0 size 688
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 49621 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4440
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #96 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #98 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b77957...
+looking for RSA pre-masterb52278e70c03ef1d2c633b02650cf3ffcddf7fb2ff9d4607...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| c6 b5 10 d5 ce 41 a7 70 e2 82 c9 33 b5 a7 9d 2d |.....A.p...3...-|
+| aa 3a 8d 73 75 01 14 d4 b8 30 43 56 d4 a5 d3 af |.:.su....0CV....|
+| 53 3c 4d 30 d8 12 9f 7c 0f b4 b0 cb 19 b3 ac 4e |S<M0...|.......N|
+| 3a 49 bd 36 70 8e 42 5e a7 0d 1e 3d a1 2a 12 f4 |:I.6p.B^...=.*..|
+| 05 af 3c b5 31 1e c5 ad |..<.1... |
+Client MAC key[20]:
+| c6 b5 10 d5 ce 41 a7 70 e2 82 c9 33 b5 a7 9d 2d |.....A.p...3...-|
+| aa 3a 8d 73 |.:.s |
+Server MAC key[20]:
+| 75 01 14 d4 b8 30 43 56 d4 a5 d3 af 53 3c 4d 30 |u....0CV....S<M0|
+| d8 12 9f 7c |...| |
+Client Write key[8]:
+| 0f b4 b0 cb 19 b3 ac 4e |.......N |
+Server Write key[8]:
+| 3a 49 bd 36 70 8e 42 5e |:I.6p.B^ |
+Client Write IV[8]:
+| a7 0d 1e 3d a1 2a 12 f4 |...=.*.. |
+Server Write IV[8]:
+| 05 af 3c b5 31 1e c5 ad |..<.1... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 15 15 e7 0e 3f a6 8c 70 55 97 dd 92 fb 48 94 36 |....?..pU....H.6|
+| b1 9a 08 f9 33 af 03 cc b1 e3 2e 91 78 b7 ca a6 |....3.......x...|
+ssl_save_session stored master secret[48]:
+| 95 cc 6f a6 96 23 48 36 54 df a3 2e 72 5b 3e 2b |..o..#H6T...r[>+|
+| a0 ae 4d 29 98 20 15 b1 96 e8 64 59 09 08 9c 90 |..M). ....dY....|
+| 6e 42 0b 07 0b bf 00 48 35 dc fa 6b 90 0e 58 66 |nB.....H5..k..Xf|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 33 86 b8 55 42 a4 c1 da 2e d3 2b 98 2b e0 c3 4d |3..UB.....+.+..M|
+| 97 69 89 f8 3f 53 d3 92 9a fd 5b 0c be ab 20 c9 |.i..?S....[... .|
+| b8 c7 0d c9 03 91 91 fa 6d 75 fe 80 de 32 00 ef |........mu...2..|
+| ee 05 7b 37 e8 2f da 41 64 1f ce b6 29 f6 82 cb |..{7./.Ad...)...|
+Plaintext[64]:
+| 14 00 00 24 1f 78 16 f6 1f 17 84 b3 a0 59 e8 ba |...$.x.......Y..|
+| 9f d6 0f b6 3e 78 4e a9 a9 9a 72 10 2a 63 9b a3 |....>xN...r.*c..|
+| 9d 85 de 52 58 17 5a 53 49 75 63 56 9d 95 cb f4 |...RX.ZSIucV....|
+| 0f c2 35 b6 3c 97 95 79 be d8 34 07 00 00 00 03 |..5.<..y..4.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #99 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 9b 67 99 15 ad 31 90 ad 43 0e a9 da 3d c2 77 ab |.g...1..C...=.w.|
+| 4b 29 3b 4e 7b fa c9 c1 c7 dd aa 5a 76 e0 fa f8 |K);N{......Zv...|
+| 81 de 4d 5f e8 bb 78 81 0d b2 82 a6 75 5e 9b 74 |..M_..x.....u^.t|
+| 75 fe 2a 43 9c ee d6 00 a4 85 09 15 be 93 6b 08 |u.*C..........k.|
+Plaintext[64]:
+| 14 00 00 24 73 1a 8d 4e 5d 8b e8 cf 4e 38 11 95 |...$s..N]...N8..|
+| d7 ac 2d 59 4a 26 b1 b2 c4 98 58 1d 7b dc 25 f7 |..-YJ&....X.{.%.|
+| cc 3e f7 bd b8 b8 ed 99 46 80 d4 5f b4 a1 5f 5e |.>......F.._.._^|
+| 74 7a 75 fd 23 f6 32 51 e4 79 fc d8 00 00 00 03 |tzu.#.2Q.y......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #100 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| f1 ee 22 20 2e 7d 17 34 a6 81 e6 7c 71 5d 92 11 |.." .}.4...|q]..|
+| 53 23 e4 6c 27 e5 c2 a0 |S#.l'... |
+Plaintext[24]:
+| 80 0a 61 92 30 49 3d 67 c9 c1 4d 69 27 54 fa 02 |..a.0I=g..Mi'T..|
+| e1 bb b1 83 00 00 00 03 |........ |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 49621 found (nil)
+association_find: TCP port 4440 found 0x3459d10
+ record: offset = 29, reported_length_remaining = 93
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 88, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 88
+Ciphertext[88]:
+| f5 36 12 c1 2a f6 d2 eb 28 97 4e e9 b3 27 a2 08 |.6..*...(.N..'..|
+| df 1f 2d e3 46 f0 f8 65 17 41 e0 56 a9 ed 5e dd |..-.F..e.A.V..^.|
+| 32 4f 42 7e 22 52 8d 2f 1f a1 2a e2 2b 16 6c 00 |2OB~"R./..*.+.l.|
+| 3e 95 1a 0c 0a 39 4f f5 17 e3 c3 fc 8b 22 ec 35 |>....9O......".5|
+| e4 42 af 69 02 a9 db 09 3a f6 ea eb 50 f0 6a 3f |.B.i....:...P.j?|
+| 2b 39 55 c6 93 7e 46 59 |+9U..~FY |
+Plaintext[88]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 2d 73 68 |Host: des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 30 0d 0a 0d |steyn.nl:4440...|
+| 0a 3d 91 c0 3c c1 51 f6 b9 df 15 6d 51 e6 d9 d4 |.=..<.Q....mQ...|
+| 71 cc 8d ec 2a 00 00 02 |q...*... |
+ssl_decrypt_record found padding 2 final len 85
+checking mac (len 65, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65
+association_find: TCP port 49621 found (nil)
+association_find: TCP port 4440 found 0x3459d10
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 2d 73 68 |Host: des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 30 0d 0a 0d |steyn.nl:4440...|
+| 0a |. |
+dissect_ssl3_record found association 0x3459d10
+
+dissect_ssl enter frame #101 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| f1 2a 57 bd 8c 91 e9 81 33 d5 97 b8 94 88 79 6d |.*W.....3.....ym|
+| 7d b1 1c 27 43 fe 5b 3d 80 e7 c7 aa 89 1c 97 99 |}..'C.[=........|
+| cf 73 ff 0c 44 32 24 7f e3 54 bc ff 4a e4 c8 69 |.s..D2$..T..J..i|
+| bc 54 88 5d 2e 77 28 30 dc 5c 7a 04 7b bc f5 e3 |.T.].w(0.\z.{...|
+| a8 e1 e0 94 aa 67 3f 6e 3f 5b a6 75 e9 c1 c8 38 |.....g?n?[.u...8|
+| 1e b3 e3 d6 b5 83 59 dd 96 91 f6 40 18 6c 67 14 |......Y....@.lg.|
+| 8b 23 f4 a7 a5 85 2d c0 45 58 bb aa f4 db db aa |.#....-.EX......|
+| c9 b3 f1 2a 2a bb 27 7b 7b d0 f5 00 ce 13 be d6 |...**.'{{.......|
+| 67 c8 56 04 f1 36 e5 48 83 69 2d 31 b3 9d da 85 |g.V..6.H.i-1....|
+| 1f f3 0a c1 c0 b1 63 e5 21 f1 68 5b 2d 7b 01 88 |......c.!.h[-{..|
+| 9b 6e 09 0d 45 4b c2 22 d2 2e 3e 32 df 69 a9 f9 |.n..EK."..>2.i..|
+| ff 70 97 bb 1b 4c f0 a1 c1 1c 67 0c 1a 61 7f 52 |.p...L....g..a.R|
+| b0 77 94 3c d5 b5 c1 81 88 89 be c4 1e 3d 58 96 |.w.<.........=X.|
+| d9 87 4c 2a 43 bb 48 be cf d6 b9 52 2d 16 23 ba |..L*C.H....R-.#.|
+| 15 1b c2 04 a3 d7 7b ad c1 59 88 5b 15 e4 2f 19 |......{..Y.[../.|
+| 62 cb 1d 50 ff 6d eb a7 65 c2 d1 05 9c 4a a2 d7 |b..P.m..e....J..|
+| 34 4f 45 0c c1 6d a1 b2 92 f5 d1 5e 8c 52 68 16 |4OE..m.....^.Rh.|
+| c8 29 5d 73 1d 0c 96 8e ce 64 8d 19 9b 78 14 f9 |.)]s.....d...x..|
+| 03 b5 d8 4e a2 5e 9b ec 86 d7 ce 54 f1 c6 f0 11 |...N.^.....T....|
+| 02 b4 ad 70 e9 eb 04 57 66 c8 a4 bb 17 77 8e 11 |...p...Wf....w..|
+| d2 91 f2 2c ab b9 29 26 2b b8 17 01 ba 2a 2d 5f |...,..)&+....*-_|
+| 7c 09 21 37 dc c2 ad 75 01 8d 1e 8d 30 cd c2 4f ||.!7...u....0..O|
+| dd e9 b3 b9 28 26 15 5b 18 ea de f3 78 8a 5b 29 |....(&.[....x.[)|
+| 68 2d 9d 07 34 81 e6 f7 |h-..4... |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 39 20 2d 20 44 45 53 2d 43 |x00,0x09 - DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 |BC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 38 ee 81 2d |nl'</script>8..-|
+| 79 b9 1c a2 de 99 db 12 43 7d c5 3c d9 70 a3 9e |y.......C}.<.p..|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4440 found 0x3459d10
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 39 20 2d 20 44 45 53 2d 43 |x00,0x09 - DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 |BC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3459d10
+
+dissect_ssl enter frame #102 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 70 85 df 76 21 cf 92 8a c8 dc e5 dc 9d a9 62 b8 |p..v!.........b.|
+| 09 89 8a bd 04 b4 ca 66 |.......f |
+Plaintext[24]:
+| 01 00 22 3f 67 f1 73 37 e9 f6 70 f9 22 48 ea fa |.."?g.s7..p."H..|
+| 2c 44 01 fe b0 07 00 01 |,D...... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #104 (first time)
+ conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| a3 11 f5 c4 69 35 7e 03 05 88 ae ff dd 18 e9 b7 |....i5~.........|
+| 75 cb 83 9d 6f de 54 2c |u...o.T, |
+Plaintext[24]:
+| 01 00 0d 17 34 dd 55 5a 95 61 a6 a0 94 f4 fc 18 |....4.UZ.a......|
+| 9b 82 f9 01 87 13 00 01 |........ |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #109 (first time)
+ssl_session_init: initializing ptr 0x7f265a937d00 size 688
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 55229 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4441
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #111 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #113 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360...
+looking for RSA pre-master305122df4df84bd261f34442b78f7032986928cac1c0c8aa...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| c2 3f df 32 50 77 e3 09 ca 2c de 9c 51 23 85 a3 |.?.2Pw...,..Q#..|
+| 9b 22 ab b6 7a 40 74 65 5f c5 e0 5b 16 47 6c c9 |."..z@te_..[.Gl.|
+| 0b 84 fa 47 13 01 04 f2 7c 16 ed 43 44 1d 41 ec |...G....|..CD.A.|
+| 55 87 3e 01 18 34 fa be 3f 4b d5 60 15 ac 71 b1 |U.>..4..?K.`..q.|
+| 0e cc b1 81 63 18 f4 1d cf 0e 39 7c c2 4d 88 48 |....c.....9|.M.H|
+| 9d d8 bf 1a ef 07 69 19 c4 a8 43 b9 04 03 0a bc |......i...C.....|
+| b5 42 97 ca a4 6a 8d de |.B...j.. |
+Client MAC key[20]:
+| c2 3f df 32 50 77 e3 09 ca 2c de 9c 51 23 85 a3 |.?.2Pw...,..Q#..|
+| 9b 22 ab b6 |.".. |
+Server MAC key[20]:
+| 7a 40 74 65 5f c5 e0 5b 16 47 6c c9 0b 84 fa 47 |z@te_..[.Gl....G|
+| 13 01 04 f2 |.... |
+Client Write key[24]:
+| 7c 16 ed 43 44 1d 41 ec 55 87 3e 01 18 34 fa be ||..CD.A.U.>..4..|
+| 3f 4b d5 60 15 ac 71 b1 |?K.`..q. |
+Server Write key[24]:
+| 0e cc b1 81 63 18 f4 1d cf 0e 39 7c c2 4d 88 48 |....c.....9|.M.H|
+| 9d d8 bf 1a ef 07 69 19 |......i. |
+Client Write IV[8]:
+| c4 a8 43 b9 04 03 0a bc |..C..... |
+Server Write IV[8]:
+| b5 42 97 ca a4 6a 8d de |.B...j.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 34 30 e3 c1 1d 8e 32 94 6a 63 23 8c a4 22 df 2c |40....2.jc#..".,|
+| c4 95 75 4c b0 e1 1f 30 37 94 a4 a5 5a 46 91 92 |..uL...07...ZF..|
+ssl_save_session stored master secret[48]:
+| 92 9c 30 16 cf 0f 05 c1 e8 6b 1d cd a3 a9 ac bf |..0......k......|
+| a8 36 a3 d1 a2 2f ab ce de 25 97 35 e5 85 99 93 |.6.../...%.5....|
+| bb fe cc e9 45 8d 89 92 91 73 60 2f 5f af 35 a7 |....E....s`/_.5.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 5e dc 28 01 11 47 da 64 26 91 d0 a6 99 eb 95 3d |^.(..G.d&......=|
+| 1d 5f 84 0e af b2 8c 45 30 59 06 45 38 04 47 9b |._.....E0Y.E8.G.|
+| b7 a6 74 8e 97 8c 4f b1 66 50 09 a7 be 31 da 69 |..t...O.fP...1.i|
+| 57 d3 34 0a 6c 8c 3d b3 ab 53 a5 fc 0d c9 14 e2 |W.4.l.=..S......|
+Plaintext[64]:
+| 14 00 00 24 5c a3 a5 28 51 27 1e ce f1 87 cf b6 |...$\..(Q'......|
+| af d1 92 7b 17 1a da 7a 18 42 34 47 2a e5 f0 9a |...{...z.B4G*...|
+| 98 57 d1 9f 25 92 fe 36 e8 3a bd 32 a3 47 1f 18 |.W..%..6.:.2.G..|
+| f7 d2 e1 6d 52 98 db a6 f1 b1 e8 69 00 00 00 03 |...mR......i....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #114 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f1 41 4c da cb b6 92 1d cd 5c 47 68 f4 84 7f d4 |.AL......\Gh....|
+| 2e d5 e6 b5 f5 2e a3 5f a5 39 78 6c a4 5f 1c bf |......._.9xl._..|
+| 91 84 26 b2 70 b5 d8 12 65 dd 6a dc 1d 9b e4 80 |..&.p...e.j.....|
+| 9a e5 d9 4b f1 42 22 73 78 87 a5 e2 0f 8a da 3f |...K.B"sx......?|
+Plaintext[64]:
+| 14 00 00 24 cb 2f f7 8a b8 70 14 61 58 b4 0c 34 |...$./...p.aX..4|
+| 92 9e 65 ea 85 24 46 c3 f8 f1 c3 ef 46 75 f5 cc |..e..$F.....Fu..|
+| a2 83 a2 33 5e 72 01 52 3d b5 ca 13 d7 d6 7c 2f |...3^r.R=.....|/|
+| 3f 77 b2 ae a1 20 d3 bb dd 3a 5a fd 00 00 00 03 |?w... ...:Z.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #115 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| bc 0a 5a 16 11 2a a2 f4 5e ba 9e d7 bd e5 33 d2 |..Z..*..^.....3.|
+| f5 42 3f 51 32 70 0b b7 |.B?Q2p.. |
+Plaintext[24]:
+| 2c d6 ed 80 b5 c2 ae fb 9a e0 6f 5e 9a 0f f8 6a |,.........o^...j|
+| 90 8e a9 93 00 00 00 03 |........ |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 55229 found (nil)
+association_find: TCP port 4441 found 0x3459da0
+ record: offset = 29, reported_length_remaining = 93
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 88, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 88
+Ciphertext[88]:
+| f6 be 8f 10 c8 17 92 5f 57 e9 8b 8b aa c0 5b 4a |......._W.....[J|
+| 1d d4 aa 21 2f 71 e7 25 48 78 dd d4 a2 f7 10 65 |...!/q.%Hx.....e|
+| b2 09 c0 32 a6 36 12 c1 2b 83 9a cb 97 05 7d bd |...2.6..+.....}.|
+| ac 57 37 40 d8 42 e8 e4 da 4c b6 76 39 d3 e0 fd |.W7@.B...L.v9...|
+| 7f c0 61 86 c5 86 e8 da 2c 97 a1 de ac 17 c0 31 |..a.....,......1|
+| 9d 89 f9 0b 60 5b a4 31 |....`[.1 |
+Plaintext[88]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 33 2d 73 |Host: des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 31 0d 0a |nsteyn.nl:4441..|
+| 0d 0a fb 73 95 a0 ae eb 87 31 af 17 42 b2 70 a8 |...s.....1..B.p.|
+| 0f 8e 9f 1f 57 2d 00 01 |....W-.. |
+ssl_decrypt_record found padding 1 final len 86
+checking mac (len 66, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 66, seq = 0, nxtseq = 66
+association_find: TCP port 55229 found (nil)
+association_find: TCP port 4441 found 0x3459da0
+dissect_ssl3_record decrypted len 66
+decrypted app data fragment[66]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 33 2d 73 |Host: des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 31 0d 0a |nsteyn.nl:4441..|
+| 0d 0a |.. |
+dissect_ssl3_record found association 0x3459da0
+
+dissect_ssl enter frame #116 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| e9 ce 7f 3c 63 59 b0 c6 94 6a 00 97 da 2f 32 2d |...<cY...j.../2-|
+| a9 00 77 ee c9 3e f2 c1 3a 8d 70 c6 4e 64 7b f9 |..w..>..:.p.Nd{.|
+| 71 b0 55 d2 79 32 fa cb 90 6e 0d d6 56 45 bf 2c |q.U.y2...n..VE.,|
+| a3 e5 05 dd 85 36 8e d5 97 6e db 09 30 a8 14 13 |.....6...n..0...|
+| bd 75 77 16 40 b6 a3 b5 eb 01 ed e4 f1 e9 86 02 |.uw.@...........|
+| a5 d1 7e 00 2e 0b a7 78 cb 2b 07 d1 67 a5 02 2e |..~....x.+..g...|
+| 45 a0 02 06 00 67 71 02 17 c7 0c b5 8e c7 3e ce |E....gq.......>.|
+| 42 b1 53 ba fc f2 c5 0e 18 2e fe a8 d9 59 0e b9 |B.S..........Y..|
+| 84 5f bd 35 c2 15 12 9b bf ec 7b 70 0a 1d e8 c6 |._.5......{p....|
+| 65 f0 ca 72 f9 2b 53 61 a3 00 6e 03 e1 5d fa 68 |e..r.+Sa..n..].h|
+| d6 37 e7 49 4c 1c 22 74 e6 4b c9 c7 5f 92 69 a3 |.7.IL."t.K.._.i.|
+| f0 c8 f7 f8 25 4c 34 b9 c0 36 fa 6d e8 5b 0e e8 |....%L4..6.m.[..|
+| 14 82 34 23 8b 75 87 9a 12 e5 b1 a2 73 11 a9 0e |..4#.u......s...|
+| 27 cc 6e b7 38 2f eb e5 8c fc 41 2c 04 8b be 7c |'.n.8/....A,...||
+| cd bd dc 03 f6 12 44 c4 79 45 03 49 f6 22 cd a9 |......D.yE.I."..|
+| 58 6e f5 5f 21 a4 a6 70 7d ec d8 f8 aa 67 ce ba |Xn._!..p}....g..|
+| 5d 67 96 1d d0 09 2d 25 24 b5 11 10 32 af e4 fb |]g....-%$...2...|
+| 09 10 e6 81 3a 12 89 28 70 6f 50 7c 06 b0 86 a2 |....:..(poP|....|
+| b5 6a f0 d4 d8 c0 2b d4 bf e9 88 43 57 2e d3 45 |.j....+....CW..E|
+| 9f 75 89 fc 41 8a e7 22 b5 9e 9a a4 82 88 92 3a |.u..A..".......:|
+| 83 b7 27 ed 93 38 1d 5e cf ce 0c 05 c7 95 bc 63 |..'..8.^.......c|
+| 7e 34 bc fe 45 db 1d d3 94 da f2 bf 9c 4b 4e 47 |~4..E........KNG|
+| 5c 57 c1 83 8b fc 8c f8 11 5a b4 a7 0d a4 97 c9 |\W.......Z......|
+| 09 50 f5 ba 25 74 57 77 |.P..%tWw |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 41 20 2d 20 44 45 53 2d 43 |x00,0x0A - DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 20 20 20 20 20 |BC3-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e cc 7d 37 a2 |nl'</script>.}7.|
+| cf 5a a7 56 e8 0a 46 82 e7 a3 12 58 07 95 24 26 |.Z.V..F....X..$&|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4441 found 0x3459da0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 41 20 2d 20 44 45 53 2d 43 |x00,0x0A - DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 20 20 20 20 20 |BC3-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3459da0
+
+dissect_ssl enter frame #117 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| f6 a8 d6 48 03 f6 fa f0 38 cc 52 9e 1b 74 22 ac |...H....8.R..t".|
+| c2 34 be 73 1a 07 74 d0 |.4.s..t. |
+Plaintext[24]:
+| 01 00 81 a7 8c c7 1d b6 6b a3 57 4f 43 4f 2c 33 |........k.WOCO,3|
+| f3 a5 e4 7f 9b d2 00 01 |........ |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #119 (first time)
+ conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 40 17 a7 ad 22 7a 4c 9d 64 ac 0d 91 52 d8 dc c5 |@..."zL.d...R...|
+| 59 31 fe c0 05 79 66 2a |Y1...yf* |
+Plaintext[24]:
+| 01 00 d3 6a 09 12 02 cb 41 8e 7e 06 10 cb 0b 29 |...j....A.~....)|
+| 41 81 d2 94 d5 09 00 01 |A....... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #124 (first time)
+ssl_session_init: initializing ptr 0x7f265a93a560 size 688
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 46947 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4443
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #126 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 1156
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1070
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 330
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 316, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 312 bytes, remaining 1147
+ record: offset = 1147, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1152 length 0 bytes, remaining 1156
+
+dissect_ssl enter frame #128 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8...
+looking for RSA pre-master00805de634e34707519547ad69cd5c304ba4f92efeb4dbbe...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| 9a d0 19 dc e7 72 fc ad cf 06 7a 96 21 e6 c6 ac |.....r....z.!...|
+| 19 79 6a c8 71 b0 21 d1 61 2c 20 8e f7 58 4c ce |.yj.q.!.a, ..XL.|
+| 28 4d 01 3b 29 90 c8 7a 6b 1d ab fa 06 bf 40 8d |(M.;)..zk.....@.|
+| a3 09 13 d9 75 83 79 7a 3c 6d 45 b2 91 e7 00 68 |....u.yz<mE....h|
+| 71 65 46 4a ce a2 b7 6c |qeFJ...l |
+Client MAC key[20]:
+| 9a d0 19 dc e7 72 fc ad cf 06 7a 96 21 e6 c6 ac |.....r....z.!...|
+| 19 79 6a c8 |.yj. |
+Server MAC key[20]:
+| 71 b0 21 d1 61 2c 20 8e f7 58 4c ce 28 4d 01 3b |q.!.a, ..XL.(M.;|
+| 29 90 c8 7a |)..z |
+Client Write key[8]:
+| 6b 1d ab fa 06 bf 40 8d |k.....@. |
+Server Write key[8]:
+| a3 09 13 d9 75 83 79 7a |....u.yz |
+Client Write IV[8]:
+| 3c 6d 45 b2 91 e7 00 68 |<mE....h |
+Server Write IV[8]:
+| 71 65 46 4a ce a2 b7 6c |qeFJ...l |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| f7 1d e0 9b 7d 02 3b d6 8a 89 90 6e a9 41 6b 85 |....}.;....n.Ak.|
+| e1 5d 24 d9 9c 80 03 4f f7 5b da f9 a7 29 77 62 |.]$....O.[...)wb|
+ssl_save_session stored master secret[48]:
+| 49 54 46 30 bd 01 6f 2f 04 30 c4 aa af cb 18 ad |ITF0..o/.0......|
+| c8 1c a0 08 80 4b 1b 91 51 a7 a9 17 63 f0 62 9e |.....K..Q...c.b.|
+| 6c a2 e5 96 92 ae ba 5a 6a a4 8a 1c ea da c7 df |l......Zj.......|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 38 45 f0 e0 65 a0 3e d7 42 9e 86 e9 8e a4 88 a4 |8E..e.>.B.......|
+| 24 44 4c e1 64 a4 04 ae 53 8b 76 63 1f d5 72 a3 |$DL.d...S.vc..r.|
+| d5 ce 74 49 41 a8 6b 1b 71 ac 30 55 99 61 fa ce |..tIA.k.q.0U.a..|
+| 96 81 ab 44 85 99 97 e4 fe 7a d8 a1 9b 1d 48 70 |...D.....z....Hp|
+Plaintext[64]:
+| 14 00 00 24 e4 a0 7e 29 40 c4 44 d8 bd 3f 24 32 |...$..~)@.D..?$2|
+| 7f a4 e1 b0 bd e7 42 2d 16 25 d3 f4 14 15 ee 2a |......B-.%.....*|
+| 12 cc 15 a1 58 e8 8e 22 64 9c 61 c7 f0 42 cb 60 |....X.."d.a..B.`|
+| 72 b4 85 8c 4e 2a 9d 0c ac f2 5a 9c 00 00 00 03 |r...N*....Z.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #129 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| ae af 68 0e c4 27 60 9a bb 46 16 ce 32 7c f7 02 |..h..'`..F..2|..|
+| 6c 10 9c 39 98 cb 9b 24 a8 34 91 82 ba ec aa ec |l..9...$.4......|
+| 29 a2 55 1e 31 78 89 38 6b 3c 94 df bf 5a 8b 7c |).U.1x.8k<...Z.||
+| 9d 97 fa 5a fa 32 0c 7e 32 ab fd 2e 69 50 8e d3 |...Z.2.~2...iP..|
+Plaintext[64]:
+| 14 00 00 24 34 ca 3f 13 c5 1a 99 d3 37 ed e3 26 |...$4.?.....7..&|
+| 81 8f ad 43 f7 a7 e6 6f c8 cb 72 35 26 ce 99 06 |...C...o..r5&...|
+| 8a dc 3e 9f 04 3f 15 da 97 e1 57 a8 15 da a4 56 |..>..?....W....V|
+| 4b fb 8b 12 9b 00 96 91 c4 da 79 a2 00 00 00 03 |K.........y.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #130 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 130
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| a3 44 51 40 f2 01 b2 cb ba 48 0d 27 05 0e 62 f9 |.DQ@.....H.'..b.|
+| 2b 02 54 93 23 ca 7f 12 |+.T.#... |
+Plaintext[24]:
+| f7 94 ba 54 e1 bb 7f b6 66 63 ef 08 1c 71 dc f4 |...T....fc...q..|
+| 9b b2 ff ab 00 00 00 03 |........ |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 46947 found (nil)
+association_find: TCP port 4443 found 0x345a6c0
+ record: offset = 29, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 81 18 de fc 95 8b bc 91 f4 d2 3e 9a 0e 08 96 14 |..........>.....|
+| e3 5e 1e 3a 67 19 ef d3 42 7b d4 53 99 5c b4 91 |.^.:g...B{.S.\..|
+| 18 2a 41 e2 f2 d1 c1 09 bb 23 3d 95 78 e9 11 cc |.*A......#=.x...|
+| 48 08 7c 6d 5a 02 d0 17 9c 45 80 a6 6b 35 f0 71 |H.|mZ....E..k5.q|
+| 71 77 c0 ba 9b 20 a6 31 cf b2 90 56 d6 70 bb a6 |qw... .1...V.p..|
+| d7 fa c9 01 17 7c 63 fb be 85 d1 e8 54 9a c0 94 |.....|c.....T...|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 33 0d 0a 0d 0a b9 6a 90 8e 50 5d 90 |:4443.....j..P].|
+| f4 77 76 7e ee 66 30 47 6e a0 65 5f f9 00 00 02 |.wv~.f0Gn.e_....|
+ssl_decrypt_record found padding 2 final len 93
+checking mac (len 73, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73
+association_find: TCP port 46947 found (nil)
+association_find: TCP port 4443 found 0x345a6c0
+dissect_ssl3_record decrypted len 73
+decrypted app data fragment[73]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 33 0d 0a 0d 0a |:4443.... |
+dissect_ssl3_record found association 0x345a6c0
+
+dissect_ssl enter frame #131 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| 19 d0 e6 03 93 cc 3a f1 33 cd 20 60 d3 7c be 4f |......:.3. `.|.O|
+| 6d 3b 71 fb fc 56 75 94 da 92 43 84 ed 46 39 f7 |m;q..Vu...C..F9.|
+| 3b 54 15 d1 2f 2d 26 b7 cd 18 55 fc 72 d1 17 2c |;T../-&...U.r..,|
+| ba 22 54 32 41 b2 97 e0 3c 77 51 2f 09 7d 36 14 |."T2A...<wQ/.}6.|
+| 7d ac 77 de 9e ad 54 6f 9c 5d 41 17 27 5d 08 9d |}.w...To.]A.']..|
+| af 62 72 d2 7e 55 f5 e1 e9 d9 99 5e 22 ec c3 d0 |.br.~U.....^"...|
+| c9 4b 65 c1 ee a3 86 34 61 d4 19 47 29 80 45 08 |.Ke....4a..G).E.|
+| 03 e3 8a 36 16 53 e3 3f a2 ec 18 bd 16 1f 19 78 |...6.S.?.......x|
+| ef 84 b0 88 10 e3 b3 39 bb 84 05 f8 68 04 5a 82 |.......9....h.Z.|
+| 8d d3 47 07 e8 44 70 a6 67 eb 6c 54 41 e2 52 51 |..G..Dp.g.lTA.RQ|
+| 8d ac cb 25 f7 72 23 9a 63 69 dc ef e1 da 95 7f |...%.r#.ci......|
+| 81 2a f1 ce 52 44 7b 90 7d 9f dc f5 90 59 11 f6 |.*..RD{.}....Y..|
+| fb 10 c3 33 62 3c 74 95 75 c3 70 42 71 b1 1b e4 |...3b<t.u.pBq...|
+| e6 2b 00 03 3b 7a 61 c7 b6 d0 d6 18 43 6d d9 ce |.+..;za.....Cm..|
+| 12 fb 2a a9 62 bf 39 49 e5 3b 47 fd c2 06 3d 5a |..*.b.9I.;G...=Z|
+| 66 c1 1c 5c ae b8 67 4b d9 5b fc 9a cd 0f e2 61 |f..\..gK.[.....a|
+| e8 65 8f da 85 d3 bf 88 bb 24 66 07 e9 59 6a dc |.e.......$f..Yj.|
+| 30 d6 0d 25 bd ba 86 e4 8e c2 0b c9 71 b7 e3 0c |0..%........q...|
+| 98 21 75 91 94 1b 18 63 b7 04 9a 67 e7 9a 4c 4c |.!u....c...g..LL|
+| b9 18 f0 0a dd eb 31 ea 2a b3 0a ba ea 10 0b 80 |......1.*.......|
+| 13 09 c6 5e cd 42 ce 4d 07 15 67 73 ae 25 8c a4 |...^.B.M..gs.%..|
+| 6a ce 68 3b 7c 06 00 cf d0 b3 10 ef 63 3a 3c 62 |j.h;|.......c:<b|
+| 3c 44 08 3b b6 d7 31 48 c4 c8 2b de cc 49 8c 9f |<D.;..1H..+..I..|
+| 96 92 dc 22 63 73 a7 11 |..."cs.. |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 32 20 2d 20 45 44 48 2d 44 |x00,0x12 - EDH-D|
+| 53 53 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SS-DES-CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 45 fb 47 4d |nl'</script>E.GM|
+| 3b c7 dc 0b f2 8e db 56 17 2e e3 fa 00 de d9 1c |;......V........|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4443 found 0x345a6c0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 32 20 2d 20 45 44 48 2d 44 |x00,0x12 - EDH-D|
+| 53 53 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SS-DES-CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345a6c0
+
+dissect_ssl enter frame #132 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 18 45 62 1b 3a 82 1c 33 45 b5 a3 bf 48 0a e3 00 |.Eb.:..3E...H...|
+| 9a d9 ea b6 12 a7 f4 1d |........ |
+Plaintext[24]:
+| 01 00 6c 09 24 3b 3f ac c0 6a 89 de 3c 57 e8 ef |..l.$;?..j..<W..|
+| 05 2d a5 c9 57 84 00 01 |.-..W... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #134 (first time)
+ conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 50 12 86 4c fe 21 03 5e f0 e6 00 fd f0 56 bb ed |P..L.!.^.....V..|
+| 6c d7 2a a4 a5 3c d7 a9 |l.*..<.. |
+Plaintext[24]:
+| 01 00 54 f1 e8 ea 86 04 f5 ae fd 88 5d e8 12 76 |..T.........]..v|
+| 77 10 0d 49 59 c5 00 01 |w..IY... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #139 (first time)
+ssl_session_init: initializing ptr 0x7f265a93cd40 size 688
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 59874 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4444
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #141 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 1155
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1069
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 329
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 315, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146
+ record: offset = 1146, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155
+
+dissect_ssl enter frame #143 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301b...
+looking for RSA pre-master00807ab3c48d7f09cdca0d8b779ca754010c7e3ada7ad6de...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 9b e8 ff 35 91 66 89 f0 af d2 a9 7e 31 0c 5c 5b |...5.f.....~1.\[|
+| 83 a8 27 22 11 6d f9 80 fd af 76 52 35 b0 a5 63 |..'".m....vR5..c|
+| 67 b5 c4 68 3d 59 0e a2 aa 14 cf 99 c4 35 67 f6 |g..h=Y.......5g.|
+| 4c cb 87 b9 67 6a c4 11 62 12 21 d7 6d 20 44 90 |L...gj..b.!.m D.|
+| d6 2a 12 dd b1 22 b8 7d 3c 6d 4d 10 98 4d c9 81 |.*...".}<mM..M..|
+| d2 36 02 90 af ee 3e 1f 50 16 81 a8 d2 e8 9c c7 |.6....>.P.......|
+| 60 f1 62 35 54 36 e4 db |`.b5T6.. |
+Client MAC key[20]:
+| 9b e8 ff 35 91 66 89 f0 af d2 a9 7e 31 0c 5c 5b |...5.f.....~1.\[|
+| 83 a8 27 22 |..'" |
+Server MAC key[20]:
+| 11 6d f9 80 fd af 76 52 35 b0 a5 63 67 b5 c4 68 |.m....vR5..cg..h|
+| 3d 59 0e a2 |=Y.. |
+Client Write key[24]:
+| aa 14 cf 99 c4 35 67 f6 4c cb 87 b9 67 6a c4 11 |.....5g.L...gj..|
+| 62 12 21 d7 6d 20 44 90 |b.!.m D. |
+Server Write key[24]:
+| d6 2a 12 dd b1 22 b8 7d 3c 6d 4d 10 98 4d c9 81 |.*...".}<mM..M..|
+| d2 36 02 90 af ee 3e 1f |.6....>. |
+Client Write IV[8]:
+| 50 16 81 a8 d2 e8 9c c7 |P....... |
+Server Write IV[8]:
+| 60 f1 62 35 54 36 e4 db |`.b5T6.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 5c 51 97 ed e2 a4 d9 56 f5 18 3d b3 e4 fe 5d 30 |\Q.....V..=...]0|
+| 6f f3 ef 15 ad 76 06 7b a9 e8 ad 85 f2 6e 4b 8d |o....v.{.....nK.|
+ssl_save_session stored master secret[48]:
+| 4a 4c c6 02 ae 6b 52 2a b5 c7 0e ee d5 94 ff 3b |JL...kR*.......;|
+| eb ea 0d 49 a9 d7 31 8c d6 50 81 c0 29 47 3f 9f |...I..1..P..)G?.|
+| 9d 82 33 40 bd 73 2f 53 cf 8f de 18 81 34 65 5c |..3@.s/S.....4e\|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b9 1e aa 28 42 23 55 29 a0 d5 e5 7c 36 b1 8f 0e |...(B#U)...|6...|
+| c8 bb 5b 7f bd 99 96 bd 81 d0 13 e3 82 f2 68 ee |..[...........h.|
+| 91 c6 18 1f 47 5b 32 18 ef 86 05 d0 ae 35 72 9a |....G[2......5r.|
+| 2b 2d e1 55 f5 a3 18 57 46 3f 67 e2 89 de 1b 85 |+-.U...WF?g.....|
+Plaintext[64]:
+| 14 00 00 24 25 29 d5 7e 49 9f a0 cb b9 48 df f9 |...$%).~I....H..|
+| ec fb f7 15 bd e9 12 a0 ca d8 06 44 4a 69 ee f0 |...........DJi..|
+| 2f 16 5a 1a f5 cf 24 87 16 c4 72 5e 7d 43 ac 01 |/.Z...$...r^}C..|
+| ce 9f 9c e7 14 98 56 df d8 08 ab a7 00 00 00 03 |......V.........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #144 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 10 5d 6b f8 f0 7a d3 61 bf c2 d5 26 35 b3 6e 99 |.]k..z.a...&5.n.|
+| 2f 23 42 38 43 d4 9d a3 2c 02 81 2b d7 dd 04 81 |/#B8C...,..+....|
+| 4c 13 be aa 68 d3 e9 b5 19 2b 98 7f 4f 84 cc f2 |L...h....+..O...|
+| b0 20 d6 5d 4f e8 5c fa 5c f7 34 8f 8d 0c d5 b6 |. .]O.\.\.4.....|
+Plaintext[64]:
+| 14 00 00 24 8b a0 13 41 d4 77 59 c4 84 6b bb 2a |...$...A.wY..k.*|
+| f9 bc e1 09 1a c4 d3 87 00 33 22 2c 59 1f 32 82 |.........3",Y.2.|
+| 49 42 6c fd 12 27 90 20 1e 6f 53 1c d3 be 37 e9 |IBl..'. .oS...7.|
+| fa 6b 35 a0 04 e8 28 86 9c 75 73 f2 00 00 00 03 |.k5...(..us.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #145 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 130
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 54 07 1a 1e c3 73 d6 10 c8 85 9f dd 14 b3 3a 79 |T....s........:y|
+| 28 7c 73 e9 99 de cf 63 |(|s....c |
+Plaintext[24]:
+| 6c f2 b8 17 7f 94 dd 43 f1 6b f6 03 e1 6c 1d d4 |l......C.k...l..|
+| 7e cf f5 81 00 00 00 03 |~....... |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 59874 found (nil)
+association_find: TCP port 4444 found 0x345a750
+ record: offset = 29, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| c8 a0 4c 36 28 bc 80 8f e4 ca 2f ab ca 95 eb bb |..L6(...../.....|
+| 9b 19 ae df c4 cc 3e 1e 7e 6e c6 4c 0b 6e 71 c6 |......>.~n.L.nq.|
+| 81 ac f3 32 a1 81 d7 22 ba 80 9e 8d 16 f0 0d d6 |...2..."........|
+| eb dd 51 fc b4 a4 94 14 76 3a 06 67 c9 c1 ec 47 |..Q.....v:.g...G|
+| 0b ca 61 51 cd 8b 9c 75 7e 5b d9 82 02 56 eb c0 |..aQ...u~[...V..|
+| 36 13 5e 61 a9 26 b3 99 8f 93 d4 55 4b 6c 53 59 |6.^a.&.....UKlSY|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 34 0d 0a 0d 0a d8 17 fb e9 90 c8 |l:4444..........|
+| 47 f7 96 21 1d 96 f9 d9 1c 86 19 23 9c 62 00 01 |G..!.......#.b..|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 74, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74
+association_find: TCP port 59874 found (nil)
+association_find: TCP port 4444 found 0x345a750
+dissect_ssl3_record decrypted len 74
+decrypted app data fragment[74]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 34 0d 0a 0d 0a |l:4444.... |
+dissect_ssl3_record found association 0x345a750
+
+dissect_ssl enter frame #146 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| 3f d9 bd 7b fb 42 50 c7 c0 e3 76 1a ab d0 ff 5f |?..{.BP...v...._|
+| e6 3d a8 f2 85 8f a3 c2 c1 06 f6 23 bd 04 e6 7d |.=.........#...}|
+| 95 3b 55 ca 1f 7e 44 d6 f5 05 bb 5a de 6a 9a a7 |.;U..~D....Z.j..|
+| fa 57 4e 65 72 dd f0 3c 1a d2 49 b6 0f 13 df 44 |.WNer..<..I....D|
+| ce 67 e9 16 0b 1a 44 08 45 af 9f fd 1f f6 6d 34 |.g....D.E.....m4|
+| 03 3f 01 f3 fd 58 c7 ea 7a 70 fa 09 93 2e af 9d |.?...X..zp......|
+| b7 91 e6 46 d2 96 fb 5f df 0e eb 16 ed 25 ab 5e |...F..._.....%.^|
+| 43 68 1d 22 eb ee f5 94 0b 59 e5 c5 c0 11 3d 3b |Ch.".....Y....=;|
+| 4c d1 23 6c 64 a8 9a 88 49 2a d0 ad 22 d2 67 44 |L.#ld...I*..".gD|
+| 3f 8c 5f 58 1a 22 06 10 9e 0a 5d 5c 51 75 86 74 |?._X."....]\Qu.t|
+| 4c b4 77 f2 ff bf 52 7c aa 4a 6a f5 b9 d3 b5 4b |L.w...R|.Jj....K|
+| d1 73 3f d7 64 9b 0f 62 e4 90 6a 00 6b e4 2c 42 |.s?.d..b..j.k.,B|
+| a4 4a 9a 99 25 32 0f a8 ba c4 45 38 25 8c b3 77 |.J..%2....E8%..w|
+| 3a d5 e2 34 b6 94 2a c0 27 5f 48 9d ae c0 26 66 |:..4..*.'_H...&f|
+| 19 a6 ba ec 09 2d eb 96 f7 6f 7e 6b 5a 9f 2f 1c |.....-...o~kZ./.|
+| 34 86 69 e3 43 d8 d6 0e f6 41 b1 77 b9 db f4 f1 |4.i.C....A.w....|
+| 0a 14 a1 db cf 1a b7 bf 28 0b 23 af 50 23 1b 51 |........(.#.P#.Q|
+| 82 80 3e 0b a6 9a fe 41 3e 00 de 5c 59 4d 52 4f |..>....A>..\YMRO|
+| f3 1b c4 a8 22 2a 29 3a cf 0c 6b 39 83 f3 7d 7f |...."*):..k9..}.|
+| 8e 05 ea c7 4f 22 d7 91 9e 3e 97 61 a4 10 06 ad |....O"...>.a....|
+| 45 58 82 97 1f 2a 5b a0 99 e2 8d 11 6c d9 ae 82 |EX...*[.....l...|
+| 32 9c 5b 2c fb da 86 86 86 4e 26 78 1b e3 72 78 |2.[,.....N&x..rx|
+| ed 2c 26 f1 c3 1f 19 a3 55 17 7b 59 7b 3e 1a a7 |.,&.....U.{Y{>..|
+| 12 b3 22 37 1e c5 bd 22 |.."7..." |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 33 20 2d 20 45 44 48 2d 44 |x00,0x13 - EDH-D|
+| 53 53 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SS-DES-CBC3-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 49 50 b1 5b |nl'</script>IP.[|
+| fc 07 a2 57 3e cc ab ca a0 e6 b7 de ee 11 fe 3c |...W>..........<|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4444 found 0x345a750
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 33 20 2d 20 45 44 48 2d 44 |x00,0x13 - EDH-D|
+| 53 53 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SS-DES-CBC3-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345a750
+
+dissect_ssl enter frame #147 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| bc 59 84 90 5f 26 64 57 19 81 62 bd 1e 9d a7 7e |.Y.._&dW..b....~|
+| fe 00 36 fa 2d 92 1f 03 |..6.-... |
+Plaintext[24]:
+| 01 00 4d 8d 73 8c f6 6f 05 d7 b8 4b c7 59 1d ff |..M.s..o...K.Y..|
+| ff 18 07 2b 51 79 00 01 |...+Qy.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #149 (first time)
+ conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 94 f7 00 56 4d eb f2 36 d0 27 41 db c6 6f fb 60 |...VM..6.'A..o.`|
+| 8a 70 e5 77 bb 22 fc 48 |.p.w.".H |
+Plaintext[24]:
+| 01 00 24 62 ed 2c f0 55 95 18 25 30 0d 32 b7 b5 |..$b.,.U..%0.2..|
+| 16 e4 5c 5e 30 26 00 01 |..\^0&.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #154 (first time)
+ssl_session_init: initializing ptr 0x7f265a93f520 size 688
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 33884 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4446
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #156 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #158 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84f...
+looking for RSA pre-master0080a046e74ffedeed810bc34ad61195062ec99ed35fb2b9...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| e9 fa 97 9d 76 7f 9d 49 40 3b d6 f8 f4 66 ed fd |....v..I@;...f..|
+| 04 95 52 78 dc 64 60 a0 60 53 d2 94 7e 7d f3 a8 |..Rx.d`.`S..~}..|
+| dd bf 13 0d 9c ba 39 3e 29 4a 2d 95 c0 bb 49 52 |......9>)J-...IR|
+| 1d 5a 17 99 9b 3e 06 50 b1 71 24 3e b1 f6 c2 90 |.Z...>.P.q$>....|
+| 28 f1 31 59 f6 05 6b a9 |(.1Y..k. |
+Client MAC key[20]:
+| e9 fa 97 9d 76 7f 9d 49 40 3b d6 f8 f4 66 ed fd |....v..I@;...f..|
+| 04 95 52 78 |..Rx |
+Server MAC key[20]:
+| dc 64 60 a0 60 53 d2 94 7e 7d f3 a8 dd bf 13 0d |.d`.`S..~}......|
+| 9c ba 39 3e |..9> |
+Client Write key[8]:
+| 29 4a 2d 95 c0 bb 49 52 |)J-...IR |
+Server Write key[8]:
+| 1d 5a 17 99 9b 3e 06 50 |.Z...>.P |
+Client Write IV[8]:
+| b1 71 24 3e b1 f6 c2 90 |.q$>.... |
+Server Write IV[8]:
+| 28 f1 31 59 f6 05 6b a9 |(.1Y..k. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 14 5e 8b ce a2 84 77 bb 23 36 f8 a2 f2 5c 3b e6 |.^....w.#6...\;.|
+| 01 98 3b 80 d1 e4 1a 54 a3 5e ce 19 65 22 94 95 |..;....T.^..e"..|
+ssl_save_session stored master secret[48]:
+| 26 e4 7d a9 54 35 80 c8 4f 02 b9 34 0e 95 03 a5 |&.}.T5..O..4....|
+| 86 ba 81 f8 cd 34 f8 a8 1f 90 07 40 0e d0 6a 79 |.....4.....@..jy|
+| 6e 5a c0 f6 8d 2f 49 56 10 cf 69 20 b9 c7 5c ea |nZ.../IV..i ..\.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 4b 44 ca 8d 7e ab a4 28 21 01 d7 2a 2a 75 87 dc |KD..~..(!..**u..|
+| 66 c3 53 d3 d3 07 d8 38 22 a0 ba b7 a6 b5 31 6d |f.S....8".....1m|
+| af 74 24 f5 fd 11 ae a9 b5 14 35 8e 76 44 96 6d |.t$.......5.vD.m|
+| ab 0e 8e 21 b3 c1 f0 91 0f 91 3e 1e cf 4c f3 b8 |...!......>..L..|
+Plaintext[64]:
+| 14 00 00 24 60 eb 93 ae f8 16 c6 bf 45 5c 1b ed |...$`.......E\..|
+| 27 1f 99 85 15 54 e4 d3 28 14 99 97 de a8 59 52 |'....T..(.....YR|
+| 3c 53 8c fe 2d 26 f5 d5 29 23 3c 2d a2 b1 28 f5 |<S..-&..)#<-..(.|
+| 44 57 25 1d 51 cb 01 8d 03 44 55 bd 00 00 00 03 |DW%.Q....DU.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #159 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f0 06 32 39 16 ce 82 a0 04 96 44 08 2b 63 3e d0 |..29......D.+c>.|
+| 70 dd 1f 8f f3 90 bd 5b 21 ff bd 0d 94 e7 72 98 |p......[!.....r.|
+| e9 4a a4 8e a5 c2 fc 80 9d d8 50 17 e3 88 1b 09 |.J........P.....|
+| 52 cc 99 a8 54 a8 c4 4f 67 ef 3e a4 2c 3f 31 e5 |R...T..Og.>.,?1.|
+Plaintext[64]:
+| 14 00 00 24 42 3c 97 db 90 8a 0e 70 8b 96 fb 1a |...$B<.....p....|
+| 7e 36 39 21 04 82 d8 b8 68 9d 7a 96 e0 59 90 08 |~69!....h.z..Y..|
+| d7 ef 1e 24 58 5b 0e b2 06 ca ca bf e2 10 00 d4 |...$X[..........|
+| 9a 3c fb a5 80 36 58 a9 29 4e 45 93 00 00 00 03 |.<...6X.)NE.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #160 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 130
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 44 29 76 72 37 4a d2 06 f5 d5 a5 bb 9b 8f 5c eb |D)vr7J........\.|
+| 01 62 a5 3c 13 00 1e 81 |.b.<.... |
+Plaintext[24]:
+| de 05 6e 70 c9 bc 0a 03 20 e7 02 1c bc 5e 17 b0 |..np.... ....^..|
+| 45 65 03 67 00 00 00 03 |Ee.g.... |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 33884 found (nil)
+association_find: TCP port 4446 found 0x345a870
+ record: offset = 29, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 6c 99 b7 6e cc 01 e4 46 30 89 e5 e7 88 ad 2e e6 |l..n...F0.......|
+| b5 ec 36 6a ce 58 8f eb 18 50 15 16 a7 8a 44 c2 |..6j.X...P....D.|
+| 2d 5f 77 11 73 d5 cf e7 3a 20 98 ee cc 44 16 92 |-_w.s...: ...D..|
+| 54 46 3c 78 51 ea c4 15 8b 2e 9f 3b be 3c 8e f9 |TF<xQ......;.<..|
+| d3 1c b1 6a 57 91 10 79 bc 8b 1b 2e f7 0a 62 d1 |...jW..y......b.|
+| 82 02 25 e7 35 2f 80 71 d7 fb 3c 4e b7 d7 e8 17 |..%.5/.q..<N....|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 72 73 61 2d 64 65 |Host: edh-rsa-de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 36 0d 0a 0d 0a 98 47 ab b9 73 51 e4 |:4446.....G..sQ.|
+| fe 1b 88 1a a2 2b 12 02 e3 f2 46 1d f2 00 00 02 |.....+....F.....|
+ssl_decrypt_record found padding 2 final len 93
+checking mac (len 73, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73
+association_find: TCP port 33884 found (nil)
+association_find: TCP port 4446 found 0x345a870
+dissect_ssl3_record decrypted len 73
+decrypted app data fragment[73]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 72 73 61 2d 64 65 |Host: edh-rsa-de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 36 0d 0a 0d 0a |:4446.... |
+dissect_ssl3_record found association 0x345a870
+
+dissect_ssl enter frame #161 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| 11 fe 30 42 8d 4a 2b 24 25 e5 9d 96 44 eb 29 d7 |..0B.J+$%...D.).|
+| 5a 2e 60 b7 38 0e 52 9a f8 33 d3 d1 73 86 f7 64 |Z.`.8.R..3..s..d|
+| 6d 66 00 b8 2a 22 83 de ef 6c f7 f5 81 21 ef ef |mf..*"...l...!..|
+| c7 2b 44 74 b8 27 1f e0 89 91 73 c8 c5 27 97 49 |.+Dt.'....s..'.I|
+| 67 43 60 24 34 38 da 24 3a b6 93 40 a8 3a 35 7d |gC`$48.$:..@.:5}|
+| e0 d4 32 b8 cb 3e f7 3d b5 13 f9 16 be a1 a6 de |..2..>.=........|
+| dd 5b 41 63 0a 3c 55 42 1a 3f 24 13 4b bd 44 9e |.[Ac.<UB.?$.K.D.|
+| 96 02 b7 a3 72 76 ea cc e3 58 af 38 8e 46 54 bf |....rv...X.8.FT.|
+| 7d a7 27 7a eb e8 b8 80 0c 8d f8 38 c8 e6 44 e0 |}.'z.......8..D.|
+| a3 9a cd 48 6a a5 55 8c c5 b1 99 cc 6e be e5 25 |...Hj.U.....n..%|
+| 51 79 1e 97 76 9d 8e 10 dd d4 a5 d2 fe 74 4c 9f |Qy..v........tL.|
+| 3c 11 ed 06 31 36 cc d7 88 00 97 b9 06 cf 66 11 |<...16........f.|
+| 27 f8 3e 58 56 df e1 7c e6 3c e0 a2 90 91 0d f7 |'.>XV..|.<......|
+| 2e 19 04 fa bc 32 97 5c 6d a6 47 e9 f5 b6 b0 01 |.....2.\m.G.....|
+| 39 6c ae 5e 02 09 ee 20 7f 9a 1b 53 05 d4 6d 3e |9l.^... ...S..m>|
+| de 30 03 53 cf ef a7 e1 3a 3d 09 77 61 f0 4f ca |.0.S....:=.wa.O.|
+| 25 d2 11 dc 2e 26 63 97 0f d1 9f 06 f5 7f 0f 36 |%....&c........6|
+| 6c 0c df 3b fa 0c 64 ec 98 fa 8c 0a 83 10 2e 8d |l..;..d.........|
+| 43 e3 cb c2 ee 87 ce 01 db b6 af 8d 35 bd 1b 9e |C...........5...|
+| e8 eb 5b fe ca 3c 28 a4 36 aa be 14 5a 4a fd f2 |..[..<(.6...ZJ..|
+| 0b 04 84 dc 8d 9e e8 83 ee 50 4b d8 db ab e7 5f |.........PK...._|
+| 98 12 73 86 fc 89 4b a8 04 a0 15 fe 26 c9 74 e5 |..s...K.....&.t.|
+| a4 b1 a7 a6 34 f7 ce 48 d9 77 f9 24 67 40 33 99 |....4..H.w.$g@3.|
+| 03 44 84 30 19 8c d8 c5 |.D.0.... |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 35 20 2d 20 45 44 48 2d 52 |x00,0x15 - EDH-R|
+| 53 41 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SA-DES-CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 4c ac 94 b1 |nl'</script>L...|
+| c2 82 e6 d0 0f 5c ab ae 76 e4 b3 a9 7b 24 ca 06 |.....\..v...{$..|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4446 found 0x345a870
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 35 20 2d 20 45 44 48 2d 52 |x00,0x15 - EDH-R|
+| 53 41 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SA-DES-CBC-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345a870
+
+dissect_ssl enter frame #162 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| dc 47 2a 1f 7f 1d 73 b6 48 d2 a7 19 3b 45 0f d7 |.G*...s.H...;E..|
+| e8 d6 5f 1f 04 ed e2 0e |.._..... |
+Plaintext[24]:
+| 01 00 87 58 bf 52 e8 d4 ef d2 1b e2 92 d8 c3 23 |...X.R.........#|
+| 4a 51 1d c8 c0 8f 00 01 |JQ...... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #164 (first time)
+ conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 75 ba 8f 45 fc 45 f8 9d fb 9b 69 03 4b a4 2a 5a |u..E.E....i.K.*Z|
+| 73 e2 25 5d f7 41 37 de |s.%].A7. |
+Plaintext[24]:
+| 01 00 5b 6d b4 90 18 9a f6 17 9f c0 50 11 3f 9c |..[m........P.?.|
+| 43 4d e0 f7 01 7b 00 01 |CM...{.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #169 (first time)
+ssl_session_init: initializing ptr 0x7f265a941cc0 size 688
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 34102 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4447
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #171 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #173 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383e...
+looking for RSA pre-master0080b5993b98996be9961f2d2863a7adc41823d9906a82ff...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| a8 a6 08 a7 38 40 cd b7 ec f5 7f ed 5b 86 36 0b |....8@......[.6.|
+| 20 9b fa 5d af 45 10 e1 b6 ef 44 58 c9 93 32 90 | ..].E....DX..2.|
+| 65 b6 37 d8 3b 62 14 40 78 64 c3 1e f2 aa 77 1b |e.7.;b.@xd....w.|
+| aa 62 cf a3 ac 0a aa d5 2a 32 39 68 3e 19 df 49 |.b......*29h>..I|
+| 04 4b 98 c3 2c a6 f7 68 70 1f d9 11 09 c4 bf 04 |.K..,..hp.......|
+| b7 c9 fe ec cf e3 70 de 1f 1c f8 1d 7a c2 4d 33 |......p.....z.M3|
+| 8d 26 1e 42 a5 cb 59 2d |.&.B..Y- |
+Client MAC key[20]:
+| a8 a6 08 a7 38 40 cd b7 ec f5 7f ed 5b 86 36 0b |....8@......[.6.|
+| 20 9b fa 5d | ..] |
+Server MAC key[20]:
+| af 45 10 e1 b6 ef 44 58 c9 93 32 90 65 b6 37 d8 |.E....DX..2.e.7.|
+| 3b 62 14 40 |;b.@ |
+Client Write key[24]:
+| 78 64 c3 1e f2 aa 77 1b aa 62 cf a3 ac 0a aa d5 |xd....w..b......|
+| 2a 32 39 68 3e 19 df 49 |*29h>..I |
+Server Write key[24]:
+| 04 4b 98 c3 2c a6 f7 68 70 1f d9 11 09 c4 bf 04 |.K..,..hp.......|
+| b7 c9 fe ec cf e3 70 de |......p. |
+Client Write IV[8]:
+| 1f 1c f8 1d 7a c2 4d 33 |....z.M3 |
+Server Write IV[8]:
+| 8d 26 1e 42 a5 cb 59 2d |.&.B..Y- |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 98 06 55 df 33 2e 33 bd 42 07 49 17 a9 8d f6 50 |..U.3.3.B.I....P|
+| 45 2d d2 0e 5c cf bb 28 38 b1 f8 34 22 7f d3 1e |E-..\..(8..4"...|
+ssl_save_session stored master secret[48]:
+| ab 74 82 08 a6 99 72 c2 2c 06 59 23 f4 3d d8 3a |.t....r.,.Y#.=.:|
+| b2 f8 6b eb e3 0e c0 5b 2a 17 1a f1 38 56 ad f2 |..k....[*...8V..|
+| 1c aa 06 ef c9 d6 58 8d 6c db 38 f6 ec 98 13 67 |......X.l.8....g|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 9e 53 59 1d 1e 3b 61 fe 7d a8 be 3f 90 51 d7 b7 |.SY..;a.}..?.Q..|
+| 00 76 48 58 89 4b 03 99 af a6 e8 a6 cc 86 0d 50 |.vHX.K.........P|
+| 3b a4 aa 23 30 04 6c 08 c7 5b 95 47 a5 af 7c 54 |;..#0.l..[.G..|T|
+| 6c 85 0c 23 3b 15 68 65 e1 f1 71 85 94 69 09 5f |l..#;.he..q..i._|
+Plaintext[64]:
+| 14 00 00 24 51 d1 51 54 72 9f 08 23 0a 76 c9 55 |...$Q.QTr..#.v.U|
+| b5 87 95 c1 b5 57 b7 41 6e 47 f0 fc 7e 27 88 70 |.....W.AnG..~'.p|
+| 9c 58 67 da 2c 6b 14 98 6f 3a 00 ad 4e 77 bd 40 |.Xg.,k..o:..Nw.@|
+| 96 ca cf 45 08 85 b7 df 9f 3f 63 1c 00 00 00 03 |...E.....?c.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #174 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cb e9 7a 07 ea 8a 95 06 3a df b7 32 b7 9f 0f 9b |..z.....:..2....|
+| 06 5f d2 78 11 b3 1a 64 de a1 c8 92 32 f3 2e 6f |._.x...d....2..o|
+| 9d 16 b4 6b 0e 85 91 a4 6e 6e a8 f4 1c bb fc dc |...k....nn......|
+| cd 49 9b 32 9a cd 2a 05 24 b3 ae da 59 3e b4 d1 |.I.2..*.$...Y>..|
+Plaintext[64]:
+| 14 00 00 24 3d 5d 9a 09 31 8b 33 ab 68 f1 3b c3 |...$=]..1.3.h.;.|
+| f3 eb be 1d 1d 6a cc 27 25 9c 4e 06 2f e5 29 4e |.....j.'%.N./.)N|
+| b1 75 89 68 6f ae d4 5d 85 40 f8 d5 f3 16 2b a4 |.u.ho..].@....+.|
+| 27 59 da a5 f0 d7 f2 31 fc 79 ad 7d 00 00 00 03 |'Y.....1.y.}....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #175 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 130
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 8f 20 2f 19 e0 b9 ff 09 15 0f 20 34 df 6b a8 08 |. /....... 4.k..|
+| 55 a1 ca 4a c0 50 91 6a |U..J.P.j |
+Plaintext[24]:
+| 8c dd ad d7 b5 db bd 77 5d 56 53 fd e6 54 df 32 |.......w]VS..T.2|
+| f6 ce 8d ce 00 00 00 03 |........ |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 34102 found (nil)
+association_find: TCP port 4447 found 0x345a900
+ record: offset = 29, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| f9 dd 72 4f 9f 2b a2 33 74 9c 7a ee 36 7b db d1 |..rO.+.3t.z.6{..|
+| df 98 28 4d 5d 76 5d 36 cf ba 9c 51 79 69 53 cf |..(M]v]6...QyiS.|
+| 27 56 d2 20 eb 39 19 68 90 29 54 ac c9 24 01 64 |'V. .9.h.)T..$.d|
+| b9 78 dd 2d cb f6 8f c8 98 d2 35 b4 09 62 13 1a |.x.-......5..b..|
+| 2e e5 9c 12 66 c9 63 8a dd 97 35 9d 88 1d d8 36 |....f.c...5....6|
+| 6f 55 4e 82 5f bc 3a 41 fe 83 c8 3e 85 ad 8d 6c |oUN._.:A...>...l|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 72 73 61 2d 64 65 |Host: edh-rsa-de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 37 0d 0a 0d 0a 92 23 8a 35 66 c1 |l:4447.....#.5f.|
+| de 14 01 d7 4c 97 fc 7f 58 85 30 77 de 0d 00 01 |....L...X.0w....|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 74, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74
+association_find: TCP port 34102 found (nil)
+association_find: TCP port 4447 found 0x345a900
+dissect_ssl3_record decrypted len 74
+decrypted app data fragment[74]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 64 68 2d 72 73 61 2d 64 65 |Host: edh-rsa-de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 37 0d 0a 0d 0a |l:4447.... |
+dissect_ssl3_record found association 0x345a900
+
+dissect_ssl enter frame #176 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| ae da 20 e3 b0 3c 7d 72 83 3f 65 66 fa 79 a0 35 |.. ..<}r.?ef.y.5|
+| 03 95 b0 f0 9f 30 99 25 8a 36 41 3b 29 83 fa ad |.....0.%.6A;)...|
+| a9 a6 41 67 04 85 13 92 22 12 50 e9 36 38 e8 6a |..Ag....".P.68.j|
+| 29 51 d4 7d 66 f0 f8 b4 cc 3d 6a 4a b2 80 cd 38 |)Q.}f....=jJ...8|
+| 24 68 c5 29 9d e5 58 98 9b 7a fb 70 b1 d2 88 f1 |$h.)..X..z.p....|
+| 73 53 42 4e ab a1 51 74 0e 48 9f 28 ad 19 43 e7 |sSBN..Qt.H.(..C.|
+| da 49 7b 95 da d0 32 39 de 65 c7 72 19 b0 a8 74 |.I{...29.e.r...t|
+| f3 43 fa 5c 05 ec c7 2d 6b d1 f0 a6 b2 e9 41 4f |.C.\...-k.....AO|
+| 7c 6b f9 f2 ee bc 97 b0 fe e6 6a 8a d7 c7 80 d0 ||k........j.....|
+| 3f 4a 3a 63 fc 6f d2 f1 36 6c 24 58 2e ce a1 b1 |?J:c.o..6l$X....|
+| 8e dc 8f ab 2e f4 a5 92 9e c1 cf 16 82 e8 bf 4b |...............K|
+| 9c 52 b5 fb 1f 5d 0d c6 e0 0b 13 2a 14 08 1f a6 |.R...].....*....|
+| 21 7d 83 50 8a 41 3e 9e 3a 6c 99 f7 00 02 62 76 |!}.P.A>.:l....bv|
+| 46 6b 8b 2c 4f eb 32 11 fe 0e c6 d0 a5 0a 48 25 |Fk.,O.2.......H%|
+| 54 31 a0 f1 2c 14 1b bb 6c d4 fc ec 3a 7e a7 c3 |T1..,...l...:~..|
+| 33 92 ee 69 4d 2e 26 31 df 4f c4 a6 b3 71 98 fc |3..iM.&1.O...q..|
+| cd 8b 27 35 8e 8f c2 15 fc fa 6a 76 e3 17 fc fc |..'5......jv....|
+| ed d8 02 ad 33 f8 8e 08 c8 38 ac b4 18 66 3f 27 |....3....8...f?'|
+| ac b5 c9 0e ea 95 53 58 4b 87 80 94 b8 dd 3e de |......SXK.....>.|
+| 9c 37 ef 3c 4e c5 b1 97 c8 ef 9d 78 dc de d8 d5 |.7.<N......x....|
+| 7c 84 37 d5 25 2d 6b 93 91 75 ba b9 29 17 f6 02 ||.7.%-k..u..)...|
+| 78 a8 23 f3 28 5e d8 0a 14 fb 58 2f 7b 6f 3e 21 |x.#.(^....X/{o>!|
+| 14 ec 3e 6e 0a cb 5d 82 03 0b 12 c8 43 c0 1d 97 |..>n..].....C...|
+| c1 79 23 5b ff af ef 8d |.y#[.... |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 36 20 2d 20 45 44 48 2d 52 |x00,0x16 - EDH-R|
+| 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SA-DES-CBC3-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e f6 44 cf 94 |nl'</script>.D..|
+| f5 ec aa 1f 10 cd f3 e2 1f f1 a5 3d b6 5e 64 dd |...........=.^d.|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4447 found 0x345a900
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 31 36 20 2d 20 45 44 48 2d 52 |x00,0x16 - EDH-R|
+| 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SA-DES-CBC3-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345a900
+
+dissect_ssl enter frame #177 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 87 07 3d 39 06 ca 14 60 63 dc f5 18 6d b3 6f 10 |..=9...`c...m.o.|
+| 4d eb 2d 27 b4 25 b7 df |M.-'.%.. |
+Plaintext[24]:
+| 01 00 20 da db 7d c9 4b 91 a1 ad a4 e2 89 45 87 |.. ..}.K......E.|
+| c1 29 c8 91 01 b1 00 01 |.)...... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #179 (first time)
+ conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 07 ea a4 8a 72 9d ae dd 6e b3 e8 b3 9d 78 5e d4 |....r...n....x^.|
+| 39 9e d8 ef 29 e1 05 1b |9...)... |
+Plaintext[24]:
+| 01 00 79 ff 92 02 f5 f0 97 78 a9 a9 81 37 4a ab |..y......x...7J.|
+| 64 0e 84 ac 2f e4 00 01 |d.../... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #184 (first time)
+ssl_session_init: initializing ptr 0x7f265a9444a0 size 688
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 56057 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4448
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #186 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #188 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e...
+looking for RSA pre-master5a4b402157a882062a4b2b19838818b8342937edf3db611c...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 7a c6 33 9c 18 11 98 dc 28 c7 e5 61 58 cd 69 e7 |z.3.....(..aX.i.|
+| 8d c6 71 9f c7 ee f3 07 9f cb f9 97 f4 82 f4 eb |..q.............|
+| 25 ae 96 a7 7e fa 87 6c 16 ca 27 c2 10 c4 03 7a |%...~..l..'....z|
+| 8f b9 3b 94 fc 86 2e b5 87 35 30 ca dd 33 37 b6 |..;......50..37.|
+| ed 94 40 c5 c2 2a 1a 41 65 0e bf 36 3a 0e 6c 74 |..@..*.Ae..6:.lt|
+| 98 a1 19 9c be b5 87 81 6a 12 49 1c 5c b7 d0 1f |........j.I.\...|
+| 82 f4 3f 46 ab 8e 59 c8 |..?F..Y. |
+Client MAC key[20]:
+| 7a c6 33 9c 18 11 98 dc 28 c7 e5 61 58 cd 69 e7 |z.3.....(..aX.i.|
+| 8d c6 71 9f |..q. |
+Server MAC key[20]:
+| c7 ee f3 07 9f cb f9 97 f4 82 f4 eb 25 ae 96 a7 |............%...|
+| 7e fa 87 6c |~..l |
+Client Write key[16]:
+| 16 ca 27 c2 10 c4 03 7a 8f b9 3b 94 fc 86 2e b5 |..'....z..;.....|
+Server Write key[16]:
+| 87 35 30 ca dd 33 37 b6 ed 94 40 c5 c2 2a 1a 41 |.50..37...@..*.A|
+Client Write IV[16]:
+| 65 0e bf 36 3a 0e 6c 74 98 a1 19 9c be b5 87 81 |e..6:.lt........|
+Server Write IV[16]:
+| 6a 12 49 1c 5c b7 d0 1f 82 f4 3f 46 ab 8e 59 c8 |j.I.\.....?F..Y.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 60 c8 27 21 df 4a 0b 60 88 e6 06 16 da 56 67 d0 |`.'!.J.`.....Vg.|
+| 32 2d 04 51 31 17 92 a7 fd ea 33 c1 0e ee ca 30 |2-.Q1.....3....0|
+ssl_save_session stored master secret[48]:
+| a1 50 7a 7e 7d 5c ca a7 9d 73 d0 de 88 16 e5 ff |.Pz~}\...s......|
+| b5 0e 99 ab 68 52 31 c6 42 94 13 0b af e0 90 ed |....hR1.B.......|
+| 1b 24 92 8e 12 af 26 64 29 e8 df 43 86 22 f0 fc |.$....&d)..C."..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 0b d3 bb 09 40 27 d4 ea 86 45 92 60 48 0b fb 89 |....@'...E.`H...|
+| 31 7c 2c 2a 96 2d 05 82 4e d0 b2 64 7e cf f4 0d |1|,*.-..N..d~...|
+| 43 89 7b a2 05 d4 40 77 ce 41 4d b4 1d 5a cb 7a |C.{...@w.AM..Z.z|
+| 3e 56 9f fe 29 5d 45 7f 83 8b ef e6 76 d0 fc 99 |>V..)]E.....v...|
+Plaintext[64]:
+| 14 00 00 24 8c 8f c5 f0 ee 18 db b0 fe 68 05 de |...$.........h..|
+| d5 e8 79 31 ba 59 0b 24 9c a1 22 28 41 79 b9 51 |..y1.Y.$.."(Ay.Q|
+| 49 e3 89 8d 95 a0 95 ab 8d a8 56 73 c5 57 9e 5b |I.........Vs.W.[|
+| 24 04 24 b1 2f 82 76 68 c6 51 e6 2a 00 00 00 03 |$.$./.vh.Q.*....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #189 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 6c 81 a0 65 5c 2d 02 36 cd 5a 6f 0e ef 91 e9 d7 |l..e\-.6.Zo.....|
+| 58 07 be c2 a6 d6 c1 49 2c 25 23 e0 71 87 a2 5d |X......I,%#.q..]|
+| 98 00 58 d5 7f 1f 76 08 bc 5e c0 c4 ad f9 eb 45 |..X...v..^.....E|
+| 2a 1b 62 a9 08 c7 e8 6c 1b 49 f8 56 d2 d6 18 90 |*.b....l.I.V....|
+Plaintext[64]:
+| 14 00 00 24 28 d9 c7 74 4b 4c 61 b0 d5 6a 57 7b |...$(..tKLa..jW{|
+| 26 fd 97 99 1b b1 c2 04 07 9e ba 4d dd b3 a4 bf |&..........M....|
+| d7 7e 67 9d ec 1b 0e 24 cf 0b dc a2 28 b8 54 a5 |.~g....$....(.T.|
+| 0f fc 0f 97 61 00 bf b8 d1 97 47 bc 00 00 00 03 |....a.....G.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #190 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| db 68 17 af e9 18 23 15 2b c0 4b fa e5 6e be fd |.h....#.+.K..n..|
+| d1 8e 79 82 21 c3 ed 94 9e 37 16 67 11 c9 80 d1 |..y.!....7.g....|
+Plaintext[32]:
+| ef 38 c3 3c 16 63 56 48 03 be 88 63 e4 3e 0b 87 |.8.<.cVH...c.>..|
+| f5 bd 1c 1c 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 56057 found (nil)
+association_find: TCP port 4448 found 0x345a990
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 97 40 76 6d 35 66 8f 61 2b 49 ef dd c2 cf 21 a3 |.@vm5f.a+I....!.|
+| 54 f6 bb ac 62 21 05 6e a2 3f ac 8b 2b 15 d5 0e |T...b!.n.?..+...|
+| 6b f2 ad 9d df 3d 5b bc f4 a1 5a 50 ec 74 15 78 |k....=[...ZP.t.x|
+| d4 0e 73 42 00 ec db f6 b3 2d c9 aa 14 6e f1 93 |..sB.....-...n..|
+| 06 08 dd 64 4c 86 6e 70 13 15 d9 64 9f 40 d2 51 |...dL.np...d.@.Q|
+| 7e fa c2 06 65 b4 ef 35 3a 39 08 a5 35 9b e6 c0 |~...e..5:9..5...|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....|
+| 18 5b c7 5d 64 ed 6e 46 9d 06 54 3a 07 48 55 cd |.[.]d.nF..T:.HU.|
+| ac 93 bd eb 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 84
+checking mac (len 64, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 64, seq = 0, nxtseq = 64
+association_find: TCP port 56057 found (nil)
+association_find: TCP port 4448 found 0x345a990
+dissect_ssl3_record decrypted len 64
+decrypted app data fragment[64]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....|
+dissect_ssl3_record found association 0x345a990
+
+dissect_ssl enter frame #191 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 70 2a 3c 79 99 f1 00 9c 87 4b 0a 69 35 f6 a4 e9 |p*<y.....K.i5...|
+| ec f9 ea e2 3b 51 80 b1 f0 fa e4 4c 8e 44 0c e6 |....;Q.....L.D..|
+| 80 fc 0e 2b f7 34 40 cb 8d 04 83 64 c1 64 4b b4 |...+.4@....d.dK.|
+| d4 05 18 f2 50 f4 b3 2c 14 fc 79 d1 8a 13 9b d7 |....P..,..y.....|
+| eb 3e d5 86 15 08 28 22 42 e0 ca 48 ce 23 6f fa |.>....("B..H.#o.|
+| 31 bd da fd f9 67 d7 7e 07 1a 5d e4 01 98 e6 43 |1....g.~..]....C|
+| a1 86 d4 2d dc e4 86 07 3a a9 08 ff 9e 5e 4d f3 |...-....:....^M.|
+| 94 41 39 f5 3f 81 90 da 36 6b 33 00 64 7e bf b3 |.A9.?...6k3.d~..|
+| 9c 67 5a 55 cb a6 44 52 10 a3 50 fa ed 88 7d 19 |.gZU..DR..P...}.|
+| e0 3c 84 48 38 8e 92 a9 7a e5 49 a5 dc 3b 29 fc |.<.H8...z.I..;).|
+| 68 49 db 31 86 9e d3 1c a9 21 b2 0c 61 a9 c3 c5 |hI.1.....!..a...|
+| 07 31 1f 86 22 80 5f 01 d6 2f bd 7a bc c5 85 e8 |.1.."._../.z....|
+| 24 83 74 c0 e9 ac 20 c7 1e ef fa 08 c0 e8 7f 77 |$.t... ........w|
+| a5 25 0e 89 86 f9 ed 6b 6b 63 b5 4f 7b c8 af b6 |.%.....kkc.O{...|
+| bd e9 ac 51 d4 1f d4 a7 93 1d 9c 76 d6 8f 4d ca |...Q.......v..M.|
+| e3 21 92 8d ce 79 d2 07 79 8f de 7e 92 94 7f 87 |.!...y..y..~....|
+| f1 3d a4 f5 37 29 44 f1 e5 56 e8 8b e8 ec b4 38 |.=..7)D..V.....8|
+| 46 06 85 b0 4d de b8 f6 27 29 82 20 cd 13 c7 a9 |F...M...'). ....|
+| ed 5f af 8e 74 19 89 39 2b b6 61 2a 61 96 9d 38 |._..t..9+.a*a..8|
+| 52 39 d7 d2 97 5a f1 72 71 83 2a 15 80 06 e9 24 |R9...Z.rq.*....$|
+| 18 71 c9 32 0f 9c 93 3e 85 f9 f3 6a de 01 09 99 |.q.2...>...j....|
+| c0 a3 48 e6 49 25 e9 b6 30 f4 65 67 31 86 9f 06 |..H.I%..0.eg1...|
+| 62 c0 e0 e5 eb 51 99 61 82 df 7e b0 55 75 97 6a |b....Q.a..~.Uu.j|
+| 2f c1 7d 5e 8f 99 5b c0 71 b8 45 46 3c de 0a cb |/.}^..[.q.EF<...|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12|
+| 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d9 68 97 34 |nl'</script>.h.4|
+| ad 80 7f 3a 40 10 b5 3b 89 62 61 b3 de 25 e9 7f |...:@..;.ba..%..|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4448 found 0x345a990
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12|
+| 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345a990
+
+dissect_ssl enter frame #192 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 19 83 de ee c5 a6 43 03 87 16 b1 bd db 45 f8 2d |......C......E.-|
+| 77 3b 7a 4a 66 0e b2 89 64 95 f1 b0 be ea dc 87 |w;zJf...d.......|
+Plaintext[32]:
+| 01 00 0c 67 74 ca 62 ea de 45 e6 e8 04 51 1c 3d |...gt.b..E...Q.=|
+| e2 60 81 f9 0a ed 00 00 00 00 00 00 00 00 00 09 |.`..............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #194 (first time)
+ conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2d 8c d2 8b 9e a1 62 75 e5 12 67 2a 6d 07 de a1 |-.....bu..g*m...|
+| 52 12 a7 71 25 b5 d8 42 ce 7d be da 90 51 a0 b7 |R..q%..B.}...Q..|
+Plaintext[32]:
+| 01 00 32 50 28 23 5e 8a f9 0d ea 17 fa 1c b4 48 |..2P(#^........H|
+| 21 bf 18 d3 9e de 00 00 00 00 00 00 00 00 00 09 |!...............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #199 (first time)
+ssl_session_init: initializing ptr 0x7f265a946d00 size 688
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 34646 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4449
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #201 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 1156
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1070
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 330
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 316, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 312 bytes, remaining 1147
+ record: offset = 1147, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1152 length 0 bytes, remaining 1156
+
+dissect_ssl enter frame #203 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a1...
+looking for RSA pre-master00805ab67b5fe5bcd772b7417f40934875d1ea2a66e00547...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 9e 7b fb 21 a3 6d a2 3c 06 eb f6 0d 3b 15 7c c3 |.{.!.m.<....;.|.|
+| 7b f0 2b 9e 54 83 e4 04 56 3e 28 d0 ab 53 78 b8 |{.+.T...V>(..Sx.|
+| c1 8b e8 dd 78 d7 74 92 f5 87 e2 4d 87 2f 7b 7c |....x.t....M./{||
+| 5f 18 a7 53 fe 95 6e 19 6e 9a a1 e9 2e 68 0d 88 |_..S..n.n....h..|
+| 1d ff a8 9c 67 64 e0 c9 df ca ea 79 73 d0 6c 07 |....gd.....ys.l.|
+| aa 79 6c d9 9b 47 08 16 87 41 d8 7b 7e 95 53 86 |.yl..G...A.{~.S.|
+| 92 01 93 40 25 80 41 26 |...@%.A& |
+Client MAC key[20]:
+| 9e 7b fb 21 a3 6d a2 3c 06 eb f6 0d 3b 15 7c c3 |.{.!.m.<....;.|.|
+| 7b f0 2b 9e |{.+. |
+Server MAC key[20]:
+| 54 83 e4 04 56 3e 28 d0 ab 53 78 b8 c1 8b e8 dd |T...V>(..Sx.....|
+| 78 d7 74 92 |x.t. |
+Client Write key[16]:
+| f5 87 e2 4d 87 2f 7b 7c 5f 18 a7 53 fe 95 6e 19 |...M./{|_..S..n.|
+Server Write key[16]:
+| 6e 9a a1 e9 2e 68 0d 88 1d ff a8 9c 67 64 e0 c9 |n....h......gd..|
+Client Write IV[16]:
+| df ca ea 79 73 d0 6c 07 aa 79 6c d9 9b 47 08 16 |...ys.l..yl..G..|
+Server Write IV[16]:
+| 87 41 d8 7b 7e 95 53 86 92 01 93 40 25 80 41 26 |.A.{~.S....@%.A&|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 79 6d a7 fd 8f bf 0e ac 06 8d 84 cc 46 b1 54 c8 |ym..........F.T.|
+| 8e 53 97 d8 ee 9f 08 86 e6 60 d7 74 83 6e 8a 64 |.S.......`.t.n.d|
+ssl_save_session stored master secret[48]:
+| 56 b0 1f 4e 1e 68 04 b2 5b d6 da 77 e2 15 f2 3c |V..N.h..[..w...<|
+| f4 86 6c 7d 0c ae e4 62 d8 8b f4 6b e1 17 00 5e |..l}...b...k...^|
+| a7 82 a0 de e0 99 33 22 98 9f 0b 15 4e 88 41 a3 |......3"....N.A.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 19 80 e2 52 e0 e1 70 85 ee d9 52 88 ab 28 bf f9 |...R..p...R..(..|
+| 8e 01 9e 8f ee 8f f1 27 1d e1 90 8d ff 59 ce 7c |.......'.....Y.||
+| 62 bc 89 ac 8e 37 85 d5 00 94 ff a7 49 45 ae f1 |b....7......IE..|
+| d5 60 fd d1 46 36 c7 aa d8 31 fe d5 07 cb 67 f3 |.`..F6...1....g.|
+Plaintext[64]:
+| 14 00 00 24 53 8c ff 5c c6 c2 6f 3a 4c 02 d0 d4 |...$S..\..o:L...|
+| 73 55 9b 30 a4 58 5a 42 8d 0b cc f5 53 37 88 ce |sU.0.XZB....S7..|
+| ce 65 99 49 34 07 e1 b6 11 d8 8e db 78 70 9c 05 |.e.I4.......xp..|
+| 43 7f f0 57 ba 83 6b ce 79 c5 b5 39 00 00 00 03 |C..W..k.y..9....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #204 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a6 ee 9e 9d 17 48 55 d9 6f bc c3 8e 36 69 91 10 |.....HU.o...6i..|
+| 9b ae 8c 9c 15 66 41 ca 2b 74 4c bc e3 63 8e 75 |.....fA.+tL..c.u|
+| 47 64 af 01 23 f4 66 5e 60 b2 b0 f4 d2 b8 11 d3 |Gd..#.f^`.......|
+| a8 1a c6 c2 1c 34 4a 2b b2 0e 18 59 05 64 25 70 |.....4J+...Y.d%p|
+Plaintext[64]:
+| 14 00 00 24 c9 22 01 45 9d c6 87 23 f0 15 36 b7 |...$.".E...#..6.|
+| ae cb 1b 8c 39 77 b7 57 9a cb 4a 96 e2 50 a4 49 |....9w.W..J..P.I|
+| ae 19 1f f7 8b dc 53 df 3e 46 7d ac 16 1f 5b b6 |......S.>F}...[.|
+| 67 97 e2 78 70 e9 fc 01 6e e0 ae e1 00 00 00 03 |g..xp...n.......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #205 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 56 70 14 b0 e9 96 f2 b7 ab e9 8c 71 6c d7 6b 5e |Vp.........ql.k^|
+| 2f 71 9b 41 c1 40 4a 6a b6 e2 3c 8a 4b 90 b4 64 |/q.A.@Jj..<.K..d|
+Plaintext[32]:
+| 15 b6 d7 05 8c fa 75 ae c6 4e bb 5a a0 bd e4 9d |......u..N.Z....|
+| c0 3c bd fc 00 00 00 00 00 00 00 00 00 00 00 0b |.<..............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 34646 found (nil)
+association_find: TCP port 4449 found 0x345aa20
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 8e 75 14 bf 60 ca 81 3b 33 54 ae 6d 2e b7 13 9e |.u..`..;3T.m....|
+| 6a c4 7e d4 bc fc a3 60 7d 36 b3 9e bb e0 39 bf |j.~....`}6....9.|
+| 40 6e cb 4f 10 6c b1 ee c3 79 51 46 59 6a 6f 9f |@n.O.l...yQFYjo.|
+| 27 b0 4d 15 31 a7 28 d8 90 23 88 3f c0 8b 5a 2e |'.M.1.(..#.?..Z.|
+| 8b 8f 7b c5 e0 88 a0 4c 87 34 93 ce a6 d9 f7 b9 |..{....L.4......|
+| e8 a9 17 48 03 4f 4c 94 fb 4f 19 6d 45 9f c2 f9 |...H.OL..O.mE...|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 34 39 0d 0a 0d 0a 63 9e ce d0 b7 87 ba 80 |4449....c.......|
+| 1c 2f ac 37 77 dd d3 f1 7a bd 48 22 00 00 00 03 |./.7w...z.H"....|
+ssl_decrypt_record found padding 3 final len 92
+checking mac (len 72, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 34646 found (nil)
+association_find: TCP port 4449 found 0x345aa20
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 34 39 0d 0a 0d 0a |4449.... |
+dissect_ssl3_record found association 0x345aa20
+
+dissect_ssl enter frame #206 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 31 de 9b 55 3a 9c 50 1b 20 7c 8f 31 d1 4a ee 5e |1..U:.P. |.1.J.^|
+| f0 d5 33 14 b6 be 53 25 58 ed c4 cb 55 d5 a0 7b |..3...S%X...U..{|
+| 64 d5 31 a8 ff 36 33 75 9f 8d 7f 5d 8f be 4d 63 |d.1..63u...]..Mc|
+| 24 45 47 89 38 01 00 ad 73 c0 0c e3 9a 54 3e 7d |$EG.8...s....T>}|
+| 6d 9f 09 97 9f 32 9b 84 2c 0b ce 97 69 b9 eb 7a |m....2..,...i..z|
+| a2 36 0d 12 b2 1c c5 4c 19 9a bd f4 19 2d 3c 75 |.6.....L.....-<u|
+| 3e cf fd 78 c1 27 a5 0f 14 67 c5 31 0c 3f fd 9a |>..x.'...g.1.?..|
+| 88 70 93 23 2a c3 c8 ff 75 af 04 21 fc a2 95 7d |.p.#*...u..!...}|
+| 0f f9 f0 52 bd a3 f1 03 54 fe 1e 6f 99 eb 3c a0 |...R....T..o..<.|
+| 7a 77 04 dd cf 4a cf 3f ef c8 c1 a8 ae 60 65 3f |zw...J.?.....`e?|
+| 33 fc e5 2b 64 f1 2e 1e 75 dd 87 cc 18 24 06 9e |3..+d...u....$..|
+| f1 67 dc 50 e1 61 18 8c d4 a1 70 ff d3 77 85 cc |.g.P.a....p..w..|
+| 45 f7 a7 0a d6 5e 7e 06 3f d4 01 36 d5 d7 40 6e |E....^~.?..6..@n|
+| f9 50 70 97 83 64 55 b7 f4 7a e9 43 21 c9 07 bd |.Pp..dU..z.C!...|
+| 81 7a 02 06 59 4c c5 91 f4 0d 8a ff 5b d3 c0 c3 |.z..YL......[...|
+| ed 49 19 d5 1f 5c 93 43 68 81 3e bd ef 1a e2 e1 |.I...\.Ch.>.....|
+| 4b a8 f5 e5 6d 4c c1 b5 65 8d 77 f2 70 e4 88 d3 |K...mL..e.w.p...|
+| 00 c0 f7 52 3f a4 1b 2f 9c 93 16 6d 46 fe 55 3f |...R?../...mF.U?|
+| e5 1f 6d 20 38 56 23 d9 8a 1a f9 12 26 28 eb 5d |..m 8V#.....&(.]|
+| fa 32 e2 0d b9 3e 21 ea 23 f8 98 6e 66 a5 c5 e9 |.2...>!.#..nf...|
+| 28 e7 89 f7 0c 63 b5 34 d7 7d 2e e7 26 21 88 3c |(....c.4.}..&!.<|
+| cc d7 f1 8a b3 4f 9e 6c 1a dd e7 39 8e 8f 26 89 |.....O.l...9..&.|
+| ab 3c 9c 5a 58 f6 da f9 24 94 69 e6 05 80 fd 19 |.<.ZX...$.i.....|
+| 77 58 ce 37 c3 08 5a 5f 9f 74 42 47 72 58 47 32 |wX.7..Z_.tBGrXG2|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D|
+| 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e e3 dc e1 2a |nl'</script>...*|
+| 39 e2 0f f0 f2 02 a3 78 8a ab 0d 0d 8b cb 2e 21 |9......x.......!|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4449 found 0x345aa20
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D|
+| 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345aa20
+
+dissect_ssl enter frame #207 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ed 27 3c b4 73 d0 de 5a 4f b9 88 5c 25 33 f5 36 |.'<.s..ZO..\%3.6|
+| e6 63 b9 6c 4d 72 c0 95 0b 63 96 dd 21 74 90 50 |.c.lMr...c..!t.P|
+Plaintext[32]:
+| 01 00 f2 25 4e 43 88 21 8c 25 bc a9 58 90 1a b6 |...%NC.!.%..X...|
+| df f6 18 15 73 7a 00 00 00 00 00 00 00 00 00 09 |....sz..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #209 (first time)
+ conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 28 da 7e db cd 5c 5b a3 96 e1 5a 13 3c 55 2d 0f |(.~..\[...Z.<U-.|
+| fe 7e 4e e2 26 82 44 e6 8a fa f9 2e 90 13 fe ed |.~N.&.D.........|
+Plaintext[32]:
+| 01 00 0e eb 80 d4 7d 21 f7 3b c8 07 05 5f 77 ff |......}!.;..._w.|
+| 7a c1 87 19 62 d3 00 00 00 00 00 00 00 00 00 09 |z...b...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #214 (first time)
+ssl_session_init: initializing ptr 0x7f265a9494e0 size 688
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 52866 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4450
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #216 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #218 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cd...
+looking for RSA pre-master00807faa022a4447ccba03e26aa70a784b5107ac44057dd6...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 4a be 53 77 4f ba 42 8f b3 f5 0d 06 e7 0f 41 35 |J.SwO.B.......A5|
+| a4 e7 d5 4e 4b a5 e5 67 2e 28 8c c8 4d 3a 62 5f |...NK..g.(..M:b_|
+| 09 51 f5 ce 8f af 16 2b 11 1a 83 40 0a e5 5c ee |.Q.....+...@..\.|
+| ef 71 bf a6 c2 b7 17 f1 44 1b d9 59 81 c5 06 d2 |.q......D..Y....|
+| a6 52 52 40 df d2 ec 50 e9 0a bb 6d c5 94 38 e7 |.RR@...P...m..8.|
+| 67 c5 55 35 ac d0 c3 d2 94 9e 1b a1 16 eb f8 62 |g.U5...........b|
+| 55 a5 b4 00 3f ba 3a 4b |U...?.:K |
+Client MAC key[20]:
+| 4a be 53 77 4f ba 42 8f b3 f5 0d 06 e7 0f 41 35 |J.SwO.B.......A5|
+| a4 e7 d5 4e |...N |
+Server MAC key[20]:
+| 4b a5 e5 67 2e 28 8c c8 4d 3a 62 5f 09 51 f5 ce |K..g.(..M:b_.Q..|
+| 8f af 16 2b |...+ |
+Client Write key[16]:
+| 11 1a 83 40 0a e5 5c ee ef 71 bf a6 c2 b7 17 f1 |...@..\..q......|
+Server Write key[16]:
+| 44 1b d9 59 81 c5 06 d2 a6 52 52 40 df d2 ec 50 |D..Y.....RR@...P|
+Client Write IV[16]:
+| e9 0a bb 6d c5 94 38 e7 67 c5 55 35 ac d0 c3 d2 |...m..8.g.U5....|
+Server Write IV[16]:
+| 94 9e 1b a1 16 eb f8 62 55 a5 b4 00 3f ba 3a 4b |.......bU...?.:K|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 4b d8 9a f2 e4 56 2b 4a 12 e9 e0 64 a4 55 d5 c8 |K....V+J...d.U..|
+| 47 e0 89 6d 8b ef e5 20 e8 1a af c6 4b a7 a0 5a |G..m... ....K..Z|
+ssl_save_session stored master secret[48]:
+| ed f9 98 b5 96 94 15 15 fb 94 a7 10 89 a6 11 0e |................|
+| 63 75 10 c3 f2 29 5e 05 e5 48 d3 83 36 8b b2 a4 |cu...)^..H..6...|
+| ab 14 92 05 1e 45 28 32 6e df b7 6f d3 f1 53 1d |.....E(2n..o..S.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c9 b2 b0 34 cf db 98 94 c1 23 d6 8f 23 18 18 ee |...4.....#..#...|
+| 39 ff 3f f3 99 96 c6 e4 e0 91 83 7f 68 d3 d5 c2 |9.?.........h...|
+| dd 40 dd 1e d5 7a ca 18 a2 15 c9 ce 32 d3 02 15 |.@...z......2...|
+| cc 9d d5 a5 d9 f7 fa a2 ce 43 47 3d 9c d0 61 3b |.........CG=..a;|
+Plaintext[64]:
+| 14 00 00 24 22 b8 34 81 9d 93 3e 37 32 76 2e 66 |...$".4...>72v.f|
+| f9 87 f4 65 ee 03 38 72 3d 98 03 26 a7 3d aa b0 |...e..8r=..&.=..|
+| d0 d2 9d 6c 28 7d 74 df f9 26 99 3f 63 0e bb 5f |...l(}t..&.?c.._|
+| 6c 1d 66 15 da f0 95 75 c6 c9 05 2e 00 00 00 03 |l.f....u........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #219 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 5e 7e b3 04 b9 4b 7e 92 98 16 49 66 cc 92 45 3d |^~...K~...If..E=|
+| 0f 69 cf 9c 26 91 e5 e1 9b 0d 3d 81 fd 2b 31 c5 |.i..&.....=..+1.|
+| 59 96 b6 ce a2 0e fa 54 0f 14 6a 7a 99 d2 05 da |Y......T..jz....|
+| cd ae 6f fd e5 c7 73 03 bb 1b 03 bd 55 62 20 33 |..o...s.....Ub 3|
+Plaintext[64]:
+| 14 00 00 24 c0 d7 89 da 7a 72 18 92 95 b0 9d 68 |...$....zr.....h|
+| 4d 08 d5 65 44 1d b4 31 33 d2 48 d3 93 4d 5f 06 |M..eD..13.H..M_.|
+| d8 7e cf e9 9b 7b aa ce 33 18 ad 18 ae 59 40 29 |.~...{..3....Y@)|
+| 7e cf 56 13 76 87 55 80 22 7a 3a 76 00 00 00 03 |~.V.v.U."z:v....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #220 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 12 10 ae 76 b2 32 fc c5 81 43 dc e3 08 6b 14 27 |...v.2...C...k.'|
+| f7 0b 7d 14 3b a0 21 a5 86 b7 f1 6e 8c 7d 1f fd |..}.;.!....n.}..|
+Plaintext[32]:
+| 13 57 37 0f 88 76 c6 34 f5 d1 98 ba e6 95 92 cd |.W7..v.4........|
+| f6 a0 1a b9 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 52866 found (nil)
+association_find: TCP port 4450 found 0x345aab0
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| c8 65 ed fb 24 08 0c 76 52 ee 5c 7a 9e 0b fd cb |.e..$..vR.\z....|
+| c6 60 95 11 46 e0 91 4c 9c 6b cb c2 a5 04 d3 26 |.`..F..L.k.....&|
+| 27 e4 fc 9d ce 7f ac 95 84 34 84 eb 78 d5 6c 8c |'........4..x.l.|
+| ee f6 e3 0d a7 db 26 cc 6d 0b e1 ff f1 24 70 88 |......&.m....$p.|
+| df 5d eb 51 03 c9 b6 78 61 95 a7 fa 08 8c a1 5e |.].Q...xa......^|
+| c5 d4 75 a8 f4 a1 d7 ce c1 d1 52 f1 6f 50 e7 27 |..u.......R.oP.'|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 30 0d 0a 0d 0a 38 ed bc 28 5a 7d 80 4e |4450....8..(Z}.N|
+| 72 53 9e c9 72 83 fb 7f 14 08 e1 04 00 00 00 03 |rS..r...........|
+ssl_decrypt_record found padding 3 final len 92
+checking mac (len 72, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 52866 found (nil)
+association_find: TCP port 4450 found 0x345aab0
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 30 0d 0a 0d 0a |4450.... |
+dissect_ssl3_record found association 0x345aab0
+
+dissect_ssl enter frame #221 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 5d 65 3e a5 ad f8 d7 9e 97 2a ba 5e 6a fc 43 7f |]e>......*.^j.C.|
+| 22 0a b8 2f f5 a7 d2 db 32 83 b5 d7 27 09 0c b7 |"../....2...'...|
+| 0c e6 8b 19 c2 a3 58 ef 6c 59 36 34 84 83 34 60 |......X.lY64..4`|
+| df 70 da f7 d0 b6 08 de 57 70 6e 1a d8 fd bd db |.p......Wpn.....|
+| 0f ea 32 0b f5 d2 0b 38 5a 37 07 5b be 3a 78 89 |..2....8Z7.[.:x.|
+| 77 55 ee d1 26 e7 6f 25 b1 61 5b 14 0c 96 8a 08 |wU..&.o%.a[.....|
+| cf 26 70 4c 46 bb 31 b9 b1 85 10 f4 ad c0 2b 59 |.&pLF.1.......+Y|
+| 79 f1 71 13 fd f1 94 72 80 0c aa 6e 27 91 c9 8b |y.q....r...n'...|
+| 48 1d ca d9 85 2c a8 c6 e1 06 fb 6f 1a a3 96 93 |H....,.....o....|
+| d5 36 ef 0c d5 65 06 13 36 c6 1d 40 ca 04 74 f2 |.6...e..6..@..t.|
+| 87 c4 a3 7b 2c 98 e5 a2 6a a2 43 9d 27 98 7e 3f |...{,...j.C.'.~?|
+| 68 b2 49 e7 8a 5c 5f 26 d6 99 b3 cc 6d c1 63 57 |h.I..\_&....m.cW|
+| 22 28 31 cf 3d a2 9f 35 3a 72 90 04 22 b5 a8 72 |"(1.=..5:r.."..r|
+| e7 ae 7f a7 59 00 c1 74 b2 4a 2d c5 26 24 75 1c |....Y..t.J-.&$u.|
+| cf bd 04 d5 ea 3b 38 b1 01 c3 d3 7f 20 39 4f 81 |.....;8..... 9O.|
+| e8 ae 9d 1e ac ef 07 35 76 f1 d8 6b a4 1b 4e 7d |.......5v..k..N}|
+| 88 26 bd 36 e4 de 67 b0 72 f2 97 ee af 03 3a 97 |.&.6..g.r.....:.|
+| fb f5 69 8d 47 f8 0b be 9c f0 92 72 36 c8 bd 19 |..i.G......r6...|
+| 49 59 9b 29 58 bb 3b c0 e4 33 30 14 f3 f2 79 69 |IY.)X.;..30...yi|
+| 0d 49 07 83 07 22 1f cb 35 88 30 b0 f3 ac d4 7b |.I..."..5.0....{|
+| 7b cb 51 cd b3 2c c9 d9 ef 52 b3 f0 28 3f 84 ae |{.Q..,...R..(?..|
+| 99 13 3d 96 e3 c5 b0 be da 1a 67 4d 07 5a 56 79 |..=.......gM.ZVy|
+| 6d ac 48 a6 d0 88 ee c8 46 96 95 1f 37 55 bb 4d |m.H.....F...7U.M|
+| c2 70 d9 e5 ca da 10 97 f3 36 ec 76 c4 a5 06 4e |.p.......6.v...N|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R|
+| 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 17 73 39 25 |nl'</script>.s9%|
+| a2 c5 58 76 42 e4 70 99 87 eb fd e9 a8 9f 28 57 |..XvB.p.......(W|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4450 found 0x345aab0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R|
+| 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345aab0
+
+dissect_ssl enter frame #222 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 87 44 03 21 5d 29 b9 b7 b5 89 0c 90 7e 4d 02 6a |.D.!])......~M.j|
+| 0e 2f 55 f2 9f 90 cd 54 1d aa 4c 25 f8 81 c1 95 |./U....T..L%....|
+Plaintext[32]:
+| 01 00 2d 77 ce bd 0c a6 fc 29 fd f3 b1 99 49 98 |..-w.....)....I.|
+| b7 fb 2b 6c a7 a9 00 00 00 00 00 00 00 00 00 09 |..+l............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #224 (first time)
+ conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| aa 30 4e 0c 4d 42 43 33 8d 1e 72 90 a2 90 d5 25 |.0N.MBC3..r....%|
+| 74 16 ba 6a 2c 7c d2 5b f8 79 ac c2 ec 7e ba d6 |t..j,|.[.y...~..|
+Plaintext[32]:
+| 01 00 fa d1 b0 35 6e 3e 54 2c b5 23 4d 00 6f 2c |.....5n>T,.#M.o,|
+| 42 d8 dd 7e 4c d0 00 00 00 00 00 00 00 00 00 09 |B..~L...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #229 (first time)
+ssl_session_init: initializing ptr 0x7f265a94bc80 size 688
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 45463 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4451
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #231 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #233 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146...
+looking for RSA pre-master0bb3025655a4d992bad5e3bec61b9d26cc4587f589fd0282...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| bf fe 72 b8 4d f2 02 fe a2 b5 af 4c 7b 4d 08 dc |..r.M......L{M..|
+| 9c b4 8a 3a 2c 82 03 2c 09 1f ab 83 92 4b e3 1a |...:,..,.....K..|
+| d3 6c f7 1f 7e f2 d5 6b 19 ee 1a 45 6f 48 16 45 |.l..~..k...EoH.E|
+| e0 e2 e6 8c 99 14 89 62 5b f6 78 11 8e ac 7b fb |.......b[.x...{.|
+| cf 3b b6 80 a5 bc 11 09 c9 65 07 cf a0 64 3e c8 |.;.......e...d>.|
+| 03 e1 12 65 e2 ed a1 45 bb 71 e0 14 3f 50 03 cb |...e...E.q..?P..|
+| 61 d9 94 ef 35 81 d3 0c db d6 1b 3e 26 0f 3a 6b |a...5......>&.:k|
+| e8 f8 63 7d 8a f4 34 d6 ba 0b 83 df ce 39 d6 4b |..c}..4......9.K|
+| af 5f 69 9d 58 23 57 71 |._i.X#Wq |
+Client MAC key[20]:
+| bf fe 72 b8 4d f2 02 fe a2 b5 af 4c 7b 4d 08 dc |..r.M......L{M..|
+| 9c b4 8a 3a |...: |
+Server MAC key[20]:
+| 2c 82 03 2c 09 1f ab 83 92 4b e3 1a d3 6c f7 1f |,..,.....K...l..|
+| 7e f2 d5 6b |~..k |
+Client Write key[32]:
+| 19 ee 1a 45 6f 48 16 45 e0 e2 e6 8c 99 14 89 62 |...EoH.E.......b|
+| 5b f6 78 11 8e ac 7b fb cf 3b b6 80 a5 bc 11 09 |[.x...{..;......|
+Server Write key[32]:
+| c9 65 07 cf a0 64 3e c8 03 e1 12 65 e2 ed a1 45 |.e...d>....e...E|
+| bb 71 e0 14 3f 50 03 cb 61 d9 94 ef 35 81 d3 0c |.q..?P..a...5...|
+Client Write IV[16]:
+| db d6 1b 3e 26 0f 3a 6b e8 f8 63 7d 8a f4 34 d6 |...>&.:k..c}..4.|
+Server Write IV[16]:
+| ba 0b 83 df ce 39 d6 4b af 5f 69 9d 58 23 57 71 |.....9.K._i.X#Wq|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 32 2f 38 60 f3 3f 5d 5c b9 e6 d1 ff 97 ef 8f f8 |2/8`.?]\........|
+| 04 68 cf dd cf 44 0d 01 fd c5 af 11 f1 97 1f 07 |.h...D..........|
+ssl_save_session stored master secret[48]:
+| c4 88 19 65 71 8f 74 c6 f1 e1 c7 fb af 0b db dc |...eq.t.........|
+| 13 8e 06 e2 90 be 43 3a 2a 7c cb 45 d2 ba 31 40 |......C:*|.E..1@|
+| 15 5e ef 53 45 37 ed d3 94 aa 04 f1 c3 95 a7 a4 |.^.SE7..........|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 04 1a 18 0a 02 96 7c e4 13 c7 12 f8 52 da 05 05 |......|.....R...|
+| 22 e0 d2 58 e5 ee 5e 04 32 ab 06 f2 bb 24 23 17 |"..X..^.2....$#.|
+| b6 bb 78 8b 26 32 fc 40 5f 32 12 f9 3c 29 e9 e7 |..x.&2.@_2..<)..|
+| 57 d4 f3 49 6b cd b0 83 bb f9 b7 60 1b 63 8a f4 |W..Ik......`.c..|
+Plaintext[64]:
+| 14 00 00 24 5e 1e 99 c4 9a f1 03 6c 3b 45 7d 8f |...$^......l;E}.|
+| c8 78 b3 4e c9 2c 2a ca c2 d8 f8 19 ea a4 8b 80 |.x.N.,*.........|
+| 5d 08 a7 16 52 1e 60 95 dc b0 1b 0c b8 8e 81 0c |]...R.`.........|
+| b8 a7 1a fa a0 86 f2 bd 15 39 96 53 00 00 00 03 |.........9.S....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #234 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a9 7f d4 af 81 23 36 ec 2d 89 7a fc c7 18 b7 26 |.....#6.-.z....&|
+| 2c fb 82 a4 db 98 f9 ab ed 26 68 2a 58 fa 6d 9e |,........&h*X.m.|
+| 2b af 83 0c e3 d4 7f 9a 37 d3 f2 93 94 4c d6 f0 |+.......7....L..|
+| a5 b3 44 6b a0 46 37 84 8f 79 d9 ed 64 e6 4c 7d |..Dk.F7..y..d.L}|
+Plaintext[64]:
+| 14 00 00 24 4d ad d5 f2 70 a3 93 1b 06 7b 1a 9c |...$M...p....{..|
+| 86 c0 74 92 92 e0 b3 43 ff 59 4b c1 83 d7 bb 10 |..t....C.YK.....|
+| 13 76 1f 34 71 b7 d9 08 cd 4b b4 82 42 75 d1 09 |.v.4q....K..Bu..|
+| 94 2d a1 32 79 40 5f 0b 0a 0d a6 9f 00 00 00 03 |.-.2y@_.........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #235 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2f 26 00 53 51 67 44 a8 c3 3d ea 7e f2 34 82 5a |/&.SQgD..=.~.4.Z|
+| 95 4e 41 0b 40 b5 24 6d 4d ec 91 8b 42 c9 de 87 |.NA.@.$mM...B...|
+Plaintext[32]:
+| de 9d 5d 65 72 3f 91 05 52 a0 c7 ba ac 1b 66 6f |..]er?..R.....fo|
+| d2 ea d6 2c 00 00 00 00 00 00 00 00 00 00 00 0b |...,............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 45463 found (nil)
+association_find: TCP port 4451 found 0x3459f30
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 28 37 46 20 bd 12 bf 04 f2 84 a7 ec a9 bb 92 2c |(7F ...........,|
+| 4b 98 b7 b2 a2 75 23 4e fe 43 3b 8a 91 d1 46 30 |K....u#N.C;...F0|
+| 11 d7 e9 05 54 40 0f f0 82 a2 07 7a ce 69 3a b9 |....T@.....z.i:.|
+| a9 3a e8 54 e6 27 14 94 06 81 80 91 9a 2b df 3a |.:.T.'.......+.:|
+| 53 4c c2 95 00 31 f5 8f 36 9a 22 f9 75 f1 3a 35 |SL...1..6.".u.:5|
+| 02 de c2 b1 3c 56 e5 4e da ef 5f 9f 81 e1 c5 5c |....<V.N.._....\|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....|
+| af d0 bf 7c b9 8f 5d 4b 4e 90 99 12 02 2f 2a ca |...|..]KN..../*.|
+| cc 44 98 ac 00 00 00 00 00 00 00 00 00 00 00 0b |.D..............|
+ssl_decrypt_record found padding 11 final len 84
+checking mac (len 64, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 64, seq = 0, nxtseq = 64
+association_find: TCP port 45463 found (nil)
+association_find: TCP port 4451 found 0x3459f30
+dissect_ssl3_record decrypted len 64
+decrypted app data fragment[64]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....|
+dissect_ssl3_record found association 0x3459f30
+
+dissect_ssl enter frame #236 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 22 93 96 7d 33 d5 8c e4 d4 64 82 82 02 15 8d 54 |"..}3....d.....T|
+| 69 38 8b 50 f2 ca 26 08 7b 99 e8 48 a6 2e 1f 2e |i8.P..&.{..H....|
+| 32 e4 c6 ef 10 6e f4 03 06 6e 6d ff da 55 bf 10 |2....n...nm..U..|
+| 3b c3 cc 97 f0 a1 08 e0 31 d4 d4 f4 7c 95 66 be |;.......1...|.f.|
+| 64 3c c4 09 5c b6 d5 4b 0f a8 01 19 a1 0f 8f fe |d<..\..K........|
+| d9 9c 7e b3 f8 46 55 17 81 01 33 11 dc a4 48 90 |..~..FU...3...H.|
+| d1 d9 2e cc ee b3 37 52 ff 07 05 5a d2 d0 35 01 |......7R...Z..5.|
+| 63 ed 7c 50 00 79 a8 2b 9d f3 29 f4 73 db 01 6b |c.|P.y.+..).s..k|
+| c4 ab a4 41 77 b8 f9 9f 13 f2 00 48 5a e2 77 57 |...Aw......HZ.wW|
+| c6 4c ed 68 ee e0 97 cf f9 fa 82 a6 fc 1d f4 8b |.L.h............|
+| 13 b2 f9 a7 26 a4 04 36 7e a5 d1 62 3e ff 41 d8 |....&..6~..b>.A.|
+| 1b ec 1b bc 04 62 6b cc df 5d b2 31 7e d7 57 e4 |.....bk..].1~.W.|
+| 0d 04 6c 57 29 bd 00 89 b0 2f 0b bb 3b c6 fd 44 |..lW)..../..;..D|
+| d8 58 b2 c7 24 34 82 45 ea 31 ae 17 c9 f3 2e 3a |.X..$4.E.1.....:|
+| 60 21 aa 79 6f 80 ba 47 9d 4a fd c7 d9 34 b4 08 |`!.yo..G.J...4..|
+| c9 49 92 00 4b be bc d9 e4 11 c4 4f eb 3b 12 5f |.I..K......O.;._|
+| 3f 0e 98 3c b4 40 b9 be a8 46 34 43 e1 20 73 44 |?..<.@...F4C. sD|
+| b4 80 5a cf fa 73 12 fe 3d 8e 8c 1b 13 cb b6 f9 |..Z..s..=.......|
+| 25 74 8b 12 80 e3 51 da e5 54 be a4 6a 98 2d 72 |%t....Q..T..j.-r|
+| cd 60 32 e2 6b 33 f6 da f8 6f 8f 75 0e c9 8f 13 |.`2.k3...o.u....|
+| bf 7d c0 e4 6f 1d cf bc 79 16 59 79 03 f5 39 91 |.}..o...y.Yy..9.|
+| c8 8e 4c e0 65 97 9a d4 cf 76 b9 10 12 5c 7b d2 |..L.e....v...\{.|
+| 21 fc d7 3a 3c 46 a6 04 50 d1 6c 20 0e d2 54 21 |!..:<F..P.l ..T!|
+| a5 f5 96 f2 36 1a 85 23 ca f0 ba 4b c8 80 90 a3 |....6..#...K....|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25|
+| 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 31 a3 b6 86 |nl'</script>1...|
+| 41 06 86 4d dc a6 7e 75 db b9 2a cb cc ab 7e 4b |A..M..~u..*...~K|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4451 found 0x3459f30
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25|
+| 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3459f30
+
+dissect_ssl enter frame #237 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2b ba 3f f9 9d 90 85 6d 83 97 33 bd 03 3a 40 f1 |+.?....m..3..:@.|
+| 3b 25 2c 6b 72 54 bd e8 92 37 f5 4c cf 02 5e cf |;%,krT...7.L..^.|
+Plaintext[32]:
+| 01 00 60 3a 92 c3 13 cb b8 de c7 3e a4 0e f6 f2 |..`:.......>....|
+| 8f 0c 12 96 e5 4c 00 00 00 00 00 00 00 00 00 09 |.....L..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #239 (first time)
+ conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| f5 01 63 65 92 17 b9 26 af 44 78 54 f7 27 27 f2 |..ce...&.DxT.''.|
+| ce ac f7 47 a4 6b 51 ac 2b 1d 7e e0 15 1a 2d 62 |...G.kQ.+.~...-b|
+Plaintext[32]:
+| 01 00 c2 34 e5 6b a1 49 8b 7e e9 e2 06 ac 10 5c |...4.k.I.~.....\|
+| 04 16 bc 48 9c 27 00 00 00 00 00 00 00 00 00 09 |...H.'..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #244 (first time)
+ssl_session_init: initializing ptr 0x7f265a94e4e0 size 688
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 44407 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4452
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #246 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 1155
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1069
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 329
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 315, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146
+ record: offset = 1146, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155
+
+dissect_ssl enter frame #248 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773...
+looking for RSA pre-master00800d6f04a715c501d5fa7c2cc5e43deb03e43f0fa70ff9...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| fd 95 51 54 e9 6a 18 b9 21 b4 da 94 5d e4 ff ad |..QT.j..!...]...|
+| 90 87 ff 04 1b 85 d8 91 ab 1f 10 91 51 9f 0b 34 |............Q..4|
+| d5 23 b7 84 8b dd 02 be 80 98 77 86 c8 26 16 fc |.#........w..&..|
+| 42 97 73 27 cf 51 02 ca 49 0b 18 5d bc ba a4 ea |B.s'.Q..I..]....|
+| 76 db c5 34 72 b1 d5 0a 1d 1c f5 2c e7 4c df 8d |v..4r......,.L..|
+| 1d 32 97 f2 42 47 07 3d 8e 73 f7 41 e7 3b c4 80 |.2..BG.=.s.A.;..|
+| 83 5b 2b ab 0b 6e 78 c5 a1 d7 e3 e2 fc b2 c9 27 |.[+..nx........'|
+| 31 34 d4 f2 b2 3f ba 38 56 b9 18 be 07 f9 90 ea |14...?.8V.......|
+| 7f 6b 9a c6 2f db 66 29 |.k../.f) |
+Client MAC key[20]:
+| fd 95 51 54 e9 6a 18 b9 21 b4 da 94 5d e4 ff ad |..QT.j..!...]...|
+| 90 87 ff 04 |.... |
+Server MAC key[20]:
+| 1b 85 d8 91 ab 1f 10 91 51 9f 0b 34 d5 23 b7 84 |........Q..4.#..|
+| 8b dd 02 be |.... |
+Client Write key[32]:
+| 80 98 77 86 c8 26 16 fc 42 97 73 27 cf 51 02 ca |..w..&..B.s'.Q..|
+| 49 0b 18 5d bc ba a4 ea 76 db c5 34 72 b1 d5 0a |I..]....v..4r...|
+Server Write key[32]:
+| 1d 1c f5 2c e7 4c df 8d 1d 32 97 f2 42 47 07 3d |...,.L...2..BG.=|
+| 8e 73 f7 41 e7 3b c4 80 83 5b 2b ab 0b 6e 78 c5 |.s.A.;...[+..nx.|
+Client Write IV[16]:
+| a1 d7 e3 e2 fc b2 c9 27 31 34 d4 f2 b2 3f ba 38 |.......'14...?.8|
+Server Write IV[16]:
+| 56 b9 18 be 07 f9 90 ea 7f 6b 9a c6 2f db 66 29 |V........k../.f)|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 92 f6 c5 a2 7b 11 66 77 6e fe fb 55 04 e2 3e 84 |....{.fwn..U..>.|
+| 3d 94 5e ca b4 8a a9 16 ab 6a 9d ce 0d af 80 b0 |=.^......j......|
+ssl_save_session stored master secret[48]:
+| e9 62 b6 bd 15 16 ef 95 e9 b1 d6 6d 46 21 f2 0a |.b.........mF!..|
+| af 55 bc 1f 52 c7 ec 57 11 62 c3 4f 90 22 92 7b |.U..R..W.b.O.".{|
+| 32 01 90 a0 45 ef 7d a3 11 44 1b e7 2e f8 e4 80 |2...E.}..D......|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 10 81 3b 00 36 ab a1 7b 8f 49 29 bf 9d 43 8a 00 |..;.6..{.I)..C..|
+| 0d e6 69 9c 5b 80 53 aa 22 63 fe f6 58 b4 c1 9b |..i.[.S."c..X...|
+| ad 3d 7b 31 cc c1 71 b9 3c 30 70 71 3a 7b ce dc |.={1..q.<0pq:{..|
+| 75 0b 5a 20 da 8d 53 6a 59 d0 7b 9c c0 5d 1c c4 |u.Z ..SjY.{..]..|
+Plaintext[64]:
+| 14 00 00 24 85 d1 21 e5 fa f7 e2 f7 94 ef fa c6 |...$..!.........|
+| 1e 8d 00 45 e6 09 c1 7d 17 1d 47 21 ef 59 07 46 |...E...}..G!.Y.F|
+| 59 ac 6d 13 b9 73 62 39 c3 67 8e fa ef d3 e7 96 |Y.m..sb9.g......|
+| a3 5c 22 9f 71 e4 5c f6 fe fc 8d 76 00 00 00 03 |.\".q.\....v....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #249 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a9 98 91 db c8 ef df 78 5b c2 51 a6 97 ca 6c 10 |.......x[.Q...l.|
+| 17 24 06 74 9c 5f 19 51 9e 81 ef 4a 16 62 b3 24 |.$.t._.Q...J.b.$|
+| 91 85 90 48 f5 8d 98 13 59 fc 65 c6 9b 78 2d eb |...H....Y.e..x-.|
+| 95 18 78 9e 22 1b 8d 49 d4 5a 0a 33 77 3a cd 7e |..x."..I.Z.3w:.~|
+Plaintext[64]:
+| 14 00 00 24 8f ac 58 3f d7 dc 60 b9 b3 c1 da b7 |...$..X?..`.....|
+| ac ca 69 69 c3 a5 9b 83 dc 1d e7 d3 79 60 93 75 |..ii........y`.u|
+| 47 19 f9 87 71 1d a2 4f 62 67 fc ed 94 a9 91 f0 |G...q..Obg......|
+| 57 60 80 fd 76 df 3c 8c 69 d5 f4 6c 00 00 00 03 |W`..v.<.i..l....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #250 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 16 21 e6 9c dc 33 43 63 51 35 65 4c f1 e3 f8 59 |.!...3CcQ5eL...Y|
+| c9 c4 6d d2 fc 24 7f 18 d4 6d d1 8e 74 cb eb b6 |..m..$...m..t...|
+Plaintext[32]:
+| 6e 99 75 3b d8 93 87 d6 49 4f aa d8 65 75 de fa |n.u;....IO..eu..|
+| 8e 5b 04 a2 00 00 00 00 00 00 00 00 00 00 00 0b |.[..............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 44407 found (nil)
+association_find: TCP port 4452 found 0x3451d50
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| bc ea 48 f8 91 94 b4 e5 49 bd a9 c2 c2 ac 02 4f |..H.....I......O|
+| 0b 37 7d c0 70 2f 5b be cb 7f d2 6c b6 ce be 23 |.7}.p/[....l...#|
+| 8b 5f 7b 88 5a 44 6a a7 7f d9 66 3a 24 9b 33 fc |._{.ZDj...f:$.3.|
+| 3a 58 2c e0 da b1 f0 2a 10 9b ab 93 d9 14 ce a1 |:X,....*........|
+| 15 05 7d e3 36 58 03 c8 48 c5 98 31 0d 66 8e 4f |..}.6X..H..1.f.O|
+| 69 af a7 20 5e 2f bf d2 d9 e4 b2 05 82 58 d4 7d |i.. ^/.......X.}|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 32 0d 0a 0d 0a 24 1a f6 96 d8 96 d8 de |4452....$.......|
+| 7f a7 33 34 71 64 ca cb 1f c8 25 af 00 00 00 03 |..34qd....%.....|
+ssl_decrypt_record found padding 3 final len 92
+checking mac (len 72, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 44407 found (nil)
+association_find: TCP port 4452 found 0x3451d50
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 32 0d 0a 0d 0a |4452.... |
+dissect_ssl3_record found association 0x3451d50
+
+dissect_ssl enter frame #251 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| d7 34 c7 8c 42 23 d7 f7 cf e9 44 23 55 06 20 f2 |.4..B#....D#U. .|
+| 1e c1 5e 2d 79 a0 a7 3a 06 56 72 c5 0f 76 75 06 |..^-y..:.Vr..vu.|
+| f2 e8 b9 36 68 88 07 f9 e1 e4 ce 93 f5 bd fa f8 |...6h...........|
+| 37 50 f5 35 df 76 5b 88 53 d1 26 5e 28 2e e0 17 |7P.5.v[.S.&^(...|
+| d3 a6 50 1a 13 1c 1c 2a 76 6d 0b f4 01 98 d9 8f |..P....*vm......|
+| b0 6e ee 04 1a ef 70 c9 e4 0d 4d ff a8 66 33 0d |.n....p...M..f3.|
+| 18 f0 bc 74 98 27 2b 58 5d 49 cb 0d 57 cb a4 43 |...t.'+X]I..W..C|
+| a3 c2 69 6f 8c af 23 d3 e8 0f 06 a3 72 7b 11 9b |..io..#.....r{..|
+| 81 91 ce f1 e3 60 60 42 ac c6 2c cf a9 23 29 38 |.....``B..,..#)8|
+| c0 f7 2a 99 d7 51 1c c1 b5 91 cd 2f 25 9b 1a a8 |..*..Q...../%...|
+| 59 5c c4 67 8c 28 2b 2c d0 e4 37 b6 da cc 1e 3e |Y\.g.(+,..7....>|
+| 53 a1 dc f2 44 26 a2 05 b1 9f 4a 8a e3 50 e5 8d |S...D&....J..P..|
+| 68 02 ef bd 01 23 18 3e 0b a8 2f a5 a7 84 8a 8b |h....#.>../.....|
+| 74 69 79 ed 3a 5a c4 fc aa ee 9b 2c fe cc f8 a0 |tiy.:Z.....,....|
+| 20 0b 2a 5a 6e a4 e6 48 21 1d b8 e0 f9 5f cf 63 | .*Zn..H!...._.c|
+| 17 c7 a1 c8 08 d5 47 99 88 83 50 db 5f 22 12 16 |......G...P._"..|
+| 38 0b 99 bb ab 80 39 46 18 0e c7 d8 3b 5f 46 91 |8.....9F....;_F.|
+| a5 9e dd e3 f1 22 44 d8 7a d1 07 b0 14 64 06 bb |....."D.z....d..|
+| 9d 4c 9d 17 54 6a 69 4c 31 7d 7c e1 98 50 42 be |.L..TjiL1}|..PB.|
+| 24 6e 2e 10 24 f2 74 b2 75 e9 9c ce ea 5b 3d 0f |$n..$.t.u....[=.|
+| 12 b7 c0 db 60 1a db a5 f5 1b 40 93 9d 08 ac bc |....`.....@.....|
+| 31 ea 8f 2f 79 84 cc f2 dd 50 29 22 30 94 1b 69 |1../y....P)"0..i|
+| 3f e2 1c 3c d8 fa b9 0d cb 7f cd bb b5 7c 02 37 |?..<.........|.7|
+| b9 04 08 8c a9 ae b7 65 ab 4d 9a 47 e7 c4 29 97 |.......e.M.G..).|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D|
+| 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 80 cf 4b 79 |nl'</script>..Ky|
+| 6b bb ff 76 f9 13 8a 08 4b aa 98 d4 6b 93 e5 19 |k..v....K...k...|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4452 found 0x3451d50
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D|
+| 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3451d50
+
+dissect_ssl enter frame #252 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| c3 7d b1 8c 16 9c 1e 1e 87 5d 3e db 76 58 d2 b5 |.}.......]>.vX..|
+| 19 61 1e 94 c6 b5 f0 e7 1f c5 84 9e eb e8 f1 6e |.a.............n|
+Plaintext[32]:
+| 01 00 0b aa c8 5d 26 08 ee d7 e4 6f 91 fe a9 39 |.....]&....o...9|
+| cf 65 2e b5 c3 3a 00 00 00 00 00 00 00 00 00 09 |.e...:..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #254 (first time)
+ conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 16 96 1a 59 5f d7 fc 8f d1 71 3f 77 19 39 d6 bc |...Y_....q?w.9..|
+| 2c 3a 04 ad 8c ce 94 08 4d e4 54 68 eb fd e7 aa |,:......M.Th....|
+Plaintext[32]:
+| 01 00 5c 46 06 bc 9c 17 70 43 d3 18 47 2b 31 59 |..\F....pC..G+1Y|
+| 12 4f db c6 24 db 00 00 00 00 00 00 00 00 00 09 |.O..$...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #259 (first time)
+ssl_session_init: initializing ptr 0x7f265a950cc0 size 688
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 52289 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4453
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #261 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #263 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b...
+looking for RSA pre-master008064e9ccdc8d5dc992d78f59e6d78da18214cddbba5670...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| 36 5e fc 68 ca 6e f8 5e 8c 9c 01 05 b4 ad b4 86 |6^.h.n.^........|
+| b9 a1 97 58 f7 c4 59 5a ce dd 62 10 9a 9d 68 5f |...X..YZ..b...h_|
+| d2 8c b8 3d 80 a4 41 d3 9c 40 9a c9 ab 41 c3 6b |...=..A..@...A.k|
+| f2 7d 2f bd cb d9 e8 eb 3f 46 60 52 e0 32 9e 53 |.}/.....?F`R.2.S|
+| 26 99 2d 37 5a a8 21 ad e1 20 85 9f 3c 26 5f 6d |&.-7Z.!.. ..<&_m|
+| 6a ea 34 d0 67 30 86 a4 07 6d 5f 84 e9 cd e5 9a |j.4.g0...m_.....|
+| 73 ca f6 ac 36 40 2f b9 6b 97 bf c0 78 65 d8 af |s...6@/.k...xe..|
+| 02 c4 0b a9 92 0b 3f 32 0f 20 e6 be 5e 76 b0 09 |......?2. ..^v..|
+| df 6b bb cc 81 d1 b5 25 |.k.....% |
+Client MAC key[20]:
+| 36 5e fc 68 ca 6e f8 5e 8c 9c 01 05 b4 ad b4 86 |6^.h.n.^........|
+| b9 a1 97 58 |...X |
+Server MAC key[20]:
+| f7 c4 59 5a ce dd 62 10 9a 9d 68 5f d2 8c b8 3d |..YZ..b...h_...=|
+| 80 a4 41 d3 |..A. |
+Client Write key[32]:
+| 9c 40 9a c9 ab 41 c3 6b f2 7d 2f bd cb d9 e8 eb |.@...A.k.}/.....|
+| 3f 46 60 52 e0 32 9e 53 26 99 2d 37 5a a8 21 ad |?F`R.2.S&.-7Z.!.|
+Server Write key[32]:
+| e1 20 85 9f 3c 26 5f 6d 6a ea 34 d0 67 30 86 a4 |. ..<&_mj.4.g0..|
+| 07 6d 5f 84 e9 cd e5 9a 73 ca f6 ac 36 40 2f b9 |.m_.....s...6@/.|
+Client Write IV[16]:
+| 6b 97 bf c0 78 65 d8 af 02 c4 0b a9 92 0b 3f 32 |k...xe........?2|
+Server Write IV[16]:
+| 0f 20 e6 be 5e 76 b0 09 df 6b bb cc 81 d1 b5 25 |. ..^v...k.....%|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| d1 3a 23 d5 c2 39 18 c0 9f c0 c1 ef 4b e9 d7 ee |.:#..9......K...|
+| 0f e5 fd d2 be a7 ba 5a 61 c9 9e 82 3c a0 cb 4e |.......Za...<..N|
+ssl_save_session stored master secret[48]:
+| fe e1 09 c9 42 3b 8b 31 c0 5b 81 27 dd 44 8b 38 |....B;.1.[.'.D.8|
+| 5a 41 19 79 dc a3 b5 77 42 fb 61 d3 3f 44 ea 7b |ZA.y...wB.a.?D.{|
+| 56 24 18 ed de 26 2f 5b d6 cb 1d 7f 94 8f 46 41 |V$...&/[......FA|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| db 3e df 80 db 67 f0 33 77 23 11 20 d5 73 0b e8 |.>...g.3w#. .s..|
+| 06 9a 63 48 bb 41 51 e2 82 69 d5 35 84 5e c6 66 |..cH.AQ..i.5.^.f|
+| 73 26 86 3a e5 4f 8d ca 83 04 ee 3e 1e ee 40 f9 |s&.:.O.....>..@.|
+| 6a 87 f1 7d f6 d1 9b 81 25 58 5a b0 55 41 10 ab |j..}....%XZ.UA..|
+Plaintext[64]:
+| 14 00 00 24 db 41 bb a7 b4 4c e9 53 1c 99 1c 89 |...$.A...L.S....|
+| 7a ba dc c1 ea 8a cb 38 90 72 01 90 db c1 2d a2 |z......8.r....-.|
+| 39 77 32 e4 38 45 c0 12 5b f0 b5 41 e7 77 47 64 |9w2.8E..[..A.wGd|
+| 5f 28 1a 0f 5b b9 4f ea be 67 f7 b7 00 00 00 03 |_(..[.O..g......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #264 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 0c 2a b6 2b c1 4c d0 3b c4 50 bd 2f ad b3 83 c7 |.*.+.L.;.P./....|
+| ff 72 e0 4e d0 72 0d 18 d5 fe 0b ba bf d6 38 25 |.r.N.r........8%|
+| 3b f4 48 91 e7 23 55 35 ee cf 65 19 e8 69 f5 a8 |;.H..#U5..e..i..|
+| dd a3 d5 8d fa be f9 cc 1b a4 8d 10 87 26 73 75 |.............&su|
+Plaintext[64]:
+| 14 00 00 24 54 16 5f 1d d8 f9 71 da 53 56 17 d5 |...$T._...q.SV..|
+| 8f ba ba c0 8b 27 c3 04 bc c9 8c 68 fa c0 c2 d6 |.....'.....h....|
+| 72 28 71 e8 2e 82 ec 86 15 b7 5c df 84 7e de 50 |r(q.......\..~.P|
+| 4c 8c 98 f3 33 10 3d 9b e4 9d c4 f8 00 00 00 03 |L...3.=.........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #265 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 92 6e 07 23 ec ad 4c 9d 19 10 8c 18 86 92 f1 a8 |.n.#..L.........|
+| 66 bf 30 b3 7b b1 f2 ff b8 29 8c a7 d0 6a 74 76 |f.0.{....)...jtv|
+Plaintext[32]:
+| 39 48 b1 ae 7c 33 5d 2f 65 62 2c cf 75 48 60 5c |9H..|3]/eb,.uH`\|
+| a5 88 eb be 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 52289 found (nil)
+association_find: TCP port 4453 found 0x221aa70
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 70 6e 29 8d 94 ef 15 1e be 9a f0 f0 b4 81 ff a1 |pn).............|
+| 23 2c 33 e3 5c 8e 34 d0 42 7a 0b 20 97 b3 27 91 |#,3.\.4.Bz. ..'.|
+| 69 71 3b 52 9a 4e be 95 11 d3 ae 97 67 4f ed 15 |iq;R.N......gO..|
+| 74 68 bc ae 48 54 5d 11 c3 1e 9d d2 b1 53 2d e3 |th..HT]......S-.|
+| a2 10 00 0d 1b 5b 10 b0 78 aa 42 87 0d b0 6b d3 |.....[..x.B...k.|
+| 1d 8d 2b 27 6a 66 1d bc c7 40 0f 39 20 44 de d4 |..+'jf...@.9 D..|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 33 0d 0a 0d 0a 97 5c 7a 28 a6 81 4e bd |4453.....\z(..N.|
+| 2d ed ee 4b bb f7 ee 5b 11 23 c8 e3 00 00 00 03 |-..K...[.#......|
+ssl_decrypt_record found padding 3 final len 92
+checking mac (len 72, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 52289 found (nil)
+association_find: TCP port 4453 found 0x221aa70
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 33 0d 0a 0d 0a |4453.... |
+dissect_ssl3_record found association 0x221aa70
+
+dissect_ssl enter frame #266 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| ae b2 f3 06 12 09 a7 d6 12 6b a9 bd c7 f3 52 82 |.........k....R.|
+| 4f 09 34 d1 ce 11 55 a0 e7 15 c5 1f a1 20 18 a9 |O.4...U...... ..|
+| 20 4d e3 3a ee 28 d3 f2 e8 e0 a4 5f be a5 31 7b | M.:.(....._..1{|
+| 5f 2d f1 74 81 f1 87 cd fe 7d d2 e9 44 64 d9 05 |_-.t.....}..Dd..|
+| 91 a8 ef 77 4e cc 46 80 32 e1 e5 90 77 6e 6d a9 |...wN.F.2...wnm.|
+| fb 72 6b de 38 b6 77 41 db d3 ad 67 63 3b 02 d7 |.rk.8.wA...gc;..|
+| fb a6 f5 80 2d 68 f8 5b 50 1f 73 fa ee 14 e5 c9 |....-h.[P.s.....|
+| 30 52 bd e2 b4 37 6a 88 67 60 a3 7e 19 4b 9d f7 |0R...7j.g`.~.K..|
+| e7 83 3f d2 cb ed c4 66 67 69 ab c8 9f 7e bf 97 |..?....fgi...~..|
+| 98 8c d4 51 13 41 ee ce fb a1 13 53 d0 30 8a 71 |...Q.A.....S.0.q|
+| a9 18 04 1d 2b c6 06 96 f8 e3 68 96 7b a3 7e 43 |....+.....h.{.~C|
+| fd c3 92 ca 34 b8 85 d5 fd d2 d9 cf 21 86 7e df |....4.......!.~.|
+| 45 5f 1e 5a 02 19 af 9a 82 f4 41 a3 c1 8f bd ea |E_.Z......A.....|
+| 09 e9 27 ed 53 c5 37 c2 7e da ba d5 10 fd 3f 8f |..'.S.7.~.....?.|
+| be 0e 4f 64 fb ca c0 a9 b6 a3 c1 54 bb c9 3f a8 |..Od.......T..?.|
+| 63 99 26 3e b5 62 a0 7c eb ee d5 8f 04 76 a6 3f |c.&>.b.|.....v.?|
+| 10 7b 89 d6 a2 3d c8 12 58 a7 ee bd d3 e4 be 23 |.{...=..X......#|
+| 1f 02 ea 9a 9f ca e8 f4 3a 40 db 11 b1 75 e3 b5 |........:@...u..|
+| 0f 80 a0 7b c8 ab 98 97 33 0a 3e d8 96 9b 87 65 |...{....3.>....e|
+| ef 78 59 81 21 f7 28 a6 aa 61 1d ce 42 46 95 83 |.xY.!.(..a..BF..|
+| c8 cb 85 af 14 91 af ea 89 c1 05 e3 88 32 33 03 |.............23.|
+| f6 20 91 d2 c6 44 5b 54 14 39 78 fa 10 d2 fc 22 |. ...D[T.9x...."|
+| cf 1d 53 53 44 97 ec 21 97 b6 6e dc 2e 4a 06 3c |..SSD..!..n..J.<|
+| 07 c6 1d e9 c2 1c 41 54 8f 9f 88 0e 00 03 32 3a |......AT......2:|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R|
+| 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e eb b8 71 74 |nl'</script>..qt|
+| 3c 94 db 21 8b 20 20 85 9c 2e 45 38 78 40 76 cb |<..!. ...E8x@v.|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4453 found 0x221aa70
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R|
+| 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x221aa70
+
+dissect_ssl enter frame #267 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| a7 02 35 83 db ec 1e 8a f3 dd 3a 69 01 d4 31 88 |..5.......:i..1.|
+| 73 e3 f4 3c 95 b0 bb 95 00 b5 51 c5 3d be c5 61 |s..<......Q.=..a|
+Plaintext[32]:
+| 01 00 be a1 41 ed 62 ff cc ba 9a 07 a4 66 ef a2 |....A.b......f..|
+| b4 de fc 2a d6 bb 00 00 00 00 00 00 00 00 00 09 |...*............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #269 (first time)
+ conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| aa ff 34 d5 35 c4 2a 1b 72 df 14 7f de 09 e0 2e |..4.5.*.r.......|
+| 82 6e 66 7d 62 b5 00 76 08 72 93 48 9e 1b 90 21 |.nf}b..v.r.H...!|
+Plaintext[32]:
+| 01 00 3b 84 cf e5 c8 3a e6 76 97 7c cf 24 81 26 |..;....:.v.|.$.&|
+| 99 a6 e2 3f 63 63 00 00 00 00 00 00 00 00 00 09 |...?cc..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #274 (first time)
+ssl_session_init: initializing ptr 0x7f265a9534a0 size 688
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 49805 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4457
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #276 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #278 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c4...
+looking for RSA pre-masterafe34cf189316e66a7fef8feecc13a1ddc71b68a1506f8c1...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 1f d5 35 7e 33 78 6b 1f 08 ab a3 74 f0 75 db e0 |..5~3xk....t.u..|
+| 49 ee bc 01 c8 9c f3 be 43 eb 47 46 2e 8a 56 27 |I.......C.GF..V'|
+| 45 63 60 e9 e5 5d b4 47 29 56 70 f9 97 c4 6b ce |Ec`..].G)Vp...k.|
+| 32 99 e2 1a 1d 6b 45 72 4a 6a 0a 48 e7 03 8e 54 |2....kErJj.H...T|
+| d1 07 a3 c8 77 5a 9e b4 7e f8 a8 7c f2 11 3c 76 |....wZ..~..|..<v|
+| e4 4f 9a 30 c4 66 c4 cb 6b df 8e ea 75 db 14 ad |.O.0.f..k...u...|
+| 52 a6 8d a6 b8 d2 7f 4c |R......L |
+Client MAC key[20]:
+| 1f d5 35 7e 33 78 6b 1f 08 ab a3 74 f0 75 db e0 |..5~3xk....t.u..|
+| 49 ee bc 01 |I... |
+Server MAC key[20]:
+| c8 9c f3 be 43 eb 47 46 2e 8a 56 27 45 63 60 e9 |....C.GF..V'Ec`.|
+| e5 5d b4 47 |.].G |
+Client Write key[16]:
+| 29 56 70 f9 97 c4 6b ce 32 99 e2 1a 1d 6b 45 72 |)Vp...k.2....kEr|
+Server Write key[16]:
+| 4a 6a 0a 48 e7 03 8e 54 d1 07 a3 c8 77 5a 9e b4 |Jj.H...T....wZ..|
+Client Write IV[16]:
+| 7e f8 a8 7c f2 11 3c 76 e4 4f 9a 30 c4 66 c4 cb |~..|..<v.O.0.f..|
+Server Write IV[16]:
+| 6b df 8e ea 75 db 14 ad 52 a6 8d a6 b8 d2 7f 4c |k...u...R......L|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 16 08 4f 7d f0 c0 b9 22 89 a1 c9 14 a9 4e b3 dd |..O}...".....N..|
+| 4b a7 83 01 9c 8e 1a bb ca 6c bc 68 de d9 b1 48 |K........l.h...H|
+ssl_save_session stored master secret[48]:
+| 75 fd e1 06 bf f2 74 56 2c 49 e1 2e 7c 10 ba d1 |u.....tV,I..|...|
+| 57 4e 7c 59 34 5e e4 00 47 7a 5d d1 65 fc 91 72 |WN|Y4^..Gz].e..r|
+| 4e 15 5a 5f 9d 6b 6c de 48 45 4e bf d9 2e b2 05 |N.Z_.kl.HEN.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 98 cf 76 8c cf 89 cd 41 70 12 e2 1f 55 df 90 3a |..v....Ap...U..:|
+| 42 15 5b c7 1b 04 8a b1 d7 2e 24 36 ff 0d ba 37 |B.[.......$6...7|
+| 7e 35 47 72 fb 77 c7 7a 9c 4e 62 f5 b0 8a 76 9b |~5Gr.w.z.Nb...v.|
+| 4f 6e 7f 08 d4 d0 27 1b 67 98 41 63 41 90 9b 60 |On....'.g.AcA..`|
+Plaintext[64]:
+| 14 00 00 24 28 c0 69 d6 05 94 ea 3a c7 86 88 81 |...$(.i....:....|
+| 44 41 52 35 8d 88 5b 15 69 7d 47 ae 63 c2 18 33 |DAR5..[.i}G.c..3|
+| 3b 88 46 a1 51 b6 fb d1 62 9e 6e d3 d4 c9 f4 0e |;.F.Q...b.n.....|
+| 96 69 78 5d 42 0f 95 18 de 7f 3c f1 00 00 00 03 |.ix]B.....<.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #279 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 88 ef 1d 99 2f 5d c0 19 1a cd 85 a1 08 1e 85 73 |..../].........s|
+| ab 24 1c 5a b3 63 22 eb 3e a5 dc fd 3c b6 87 b1 |.$.Z.c".>...<...|
+| 08 20 0b 2f 16 a4 84 ce 51 73 d6 ba 5e da 82 c1 |. ./....Qs..^...|
+| e4 54 c1 63 80 b2 42 53 14 44 c4 b6 34 d2 13 a6 |.T.c..BS.D..4...|
+Plaintext[64]:
+| 14 00 00 24 82 7a 74 2f e3 e4 95 ee c4 72 4c c8 |...$.zt/.....rL.|
+| e2 47 92 12 49 50 b2 99 ba 3f d0 42 09 60 e4 d5 |.G..IP...?.B.`..|
+| 2e 06 78 fa 9a e2 19 29 bc 83 91 f3 c2 70 53 bb |..x....).....pS.|
+| 2d a6 78 c4 d2 8b 09 73 8c d1 94 1f 00 00 00 03 |-.x....s........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #280 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 54 70 91 94 2c 25 1f a3 81 ab 44 6f 02 fb 80 12 |Tp..,%....Do....|
+| fe 1e 4b b5 f9 f8 0d aa c1 8c 58 39 8a 3a 71 ed |..K.......X9.:q.|
+Plaintext[32]:
+| 41 fb f8 6b 6f ec 93 b8 91 21 5c 58 25 fd 10 44 |A..ko....!\X%..D|
+| f9 dd 56 38 00 00 00 00 00 00 00 00 00 00 00 0b |..V8............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 49805 found (nil)
+association_find: TCP port 4457 found 0x3354f40
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| d4 2d 5c e3 a2 51 f2 9b 4e b7 a0 97 42 eb 31 c2 |.-\..Q..N...B.1.|
+| 0c 50 a7 50 90 4b 43 20 cb 8c c8 12 54 9d fc 4d |.P.P.KC ....T..M|
+| 92 51 32 7f ea f2 b6 0f 96 fd f7 7e 07 9b 47 a1 |.Q2........~..G.|
+| a7 8a b4 48 c1 21 d4 53 dd 94 eb 8c 12 c0 0e 3f |...H.!.S.......?|
+| 9f ed cc 3d a2 2c e2 c4 0b 76 e9 bd 2d fb de e1 |...=.,...v..-...|
+| 6e c9 be 36 fe 45 90 db b0 c9 49 40 2f 82 8c c5 |n..6.E....I@/...|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12|
+| 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445|
+| 37 0d 0a 0d 0a f2 79 21 42 06 fe 4a 08 d1 67 c4 |7.....y!B..J..g.|
+| 50 c1 7f b6 d1 e6 a3 34 5a 00 00 00 00 00 00 06 |P......4Z.......|
+ssl_decrypt_record found padding 6 final len 89
+checking mac (len 69, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 69, seq = 0, nxtseq = 69
+association_find: TCP port 49805 found (nil)
+association_find: TCP port 4457 found 0x3354f40
+dissect_ssl3_record decrypted len 69
+decrypted app data fragment[69]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12|
+| 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445|
+| 37 0d 0a 0d 0a |7.... |
+dissect_ssl3_record found association 0x3354f40
+
+dissect_ssl enter frame #281 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 7f 7c 73 8e a6 ce af 18 b4 01 76 e2 c5 c4 09 b4 |.|s.......v.....|
+| b5 e6 26 43 77 3e c3 3c 77 b1 71 87 f1 b2 6d a4 |..&Cw>.<w.q...m.|
+| b2 5a bc 7d b7 a6 15 11 73 49 46 db bd 5a c0 eb |.Z.}....sIF..Z..|
+| 47 72 75 f9 18 b1 ce 0e 44 67 23 2d 25 7d 9f 5c |Gru.....Dg#-%}.\|
+| cc a2 87 96 32 84 92 7c 30 e3 66 4b 2e 52 7d 74 |....2..|0.fK.R}t|
+| dd 1f b9 a5 84 44 dd fe 42 9a 3c c0 ad bf 95 10 |.....D..B.<.....|
+| 5a eb 9b f5 31 e5 88 57 5f 1b 54 c1 dc 86 c5 e9 |Z...1..W_.T.....|
+| 42 cc d3 2e 31 0e 42 e5 e3 d2 26 c9 18 90 26 b2 |B...1.B...&...&.|
+| f2 e8 b9 97 b7 b5 2b 84 fe 44 9e 32 de bb 41 10 |......+..D.2..A.|
+| 1e be 2c 67 5c 03 1e a7 55 86 21 f1 3d 54 6f 19 |..,g\...U.!.=To.|
+| 18 02 34 9a e0 95 f2 d7 ce 7f 1e 37 92 e6 11 d5 |..4........7....|
+| a2 2f de 88 2f b8 e3 48 e3 df dc 65 04 98 ae bf |./../..H...e....|
+| c7 90 0a 08 0a 69 cb fb 8c cd 7b 8f 10 a9 6f e9 |.....i....{...o.|
+| 57 6d d8 eb 97 10 fc bf ee f6 25 01 df 69 fb fc |Wm........%..i..|
+| 4b 6b b2 5a 80 79 59 e1 71 23 5c 8a 96 c6 a6 35 |Kk.Z.yY.q#\....5|
+| 00 ee 30 b3 95 dd 1b a1 ed fd 19 07 54 8e fd 34 |..0.........T..4|
+| 23 b5 c9 62 47 0d 54 fc 10 ad fe f3 b7 2d 12 12 |#..bG.T......-..|
+| c3 ff b2 ee 6e 80 fc 10 22 a8 13 49 14 29 5f 17 |....n..."..I.)_.|
+| 03 9b 35 12 50 88 ad 25 3a 20 69 61 1d 5b 0b f1 |..5.P..%: ia.[..|
+| fe cd 33 be e5 84 40 ad c0 5e 1f 76 48 ec 4f f3 |..3...@..^.vH.O.|
+| 5b 3b 93 66 7c a8 69 d9 df 7f 55 48 fd 26 af b6 |[;.f|.i...UH.&..|
+| 28 76 68 28 02 dc cc 1a 2a 08 bf 23 fa 64 83 01 |(vh(....*..#.d..|
+| 4b cb 3d ea 62 6b 13 1a 35 23 0e 1e 78 00 52 79 |K.=.bk..5#..x.Ry|
+| 3a ec 4e bb 72 53 c2 ec 81 77 05 cf b6 e4 ab eb |:.N.rS...w......|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL|
+| 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| b0 4c 3c e7 6a ed 66 f5 4f ce c6 a1 59 70 a1 96 |.L<.j.f.O...Yp..|
+| b0 c4 25 c0 00 00 00 00 00 00 00 00 00 00 00 0b |..%.............|
+ssl_decrypt_record found padding 11 final len 372
+checking mac (len 352, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352
+association_find: TCP port 4457 found 0x3354f40
+dissect_ssl3_record decrypted len 352
+decrypted app data fragment[352]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL|
+| 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+dissect_ssl3_record found association 0x3354f40
+
+dissect_ssl enter frame #282 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| f1 cc 64 b6 95 80 ed 56 50 c5 2a 93 26 a1 7e 62 |..d....VP.*.&.~b|
+| d6 03 e2 1a de 07 9a e0 52 1d 58 0e c8 3e 7a 92 |........R.X..>z.|
+Plaintext[32]:
+| 01 00 ea 96 83 be 98 a8 1d 3b 14 c6 9c a8 20 a8 |.........;.... .|
+| 85 51 17 52 f1 f8 00 00 00 00 00 00 00 00 00 09 |.Q.R............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #284 (first time)
+ conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 5e 60 b8 32 1f 3c 40 6d 21 f5 7c ae cc e8 b4 9e |^`.2.<@m!.|.....|
+| 2a ae 23 3a 75 de 60 07 51 e5 88 b8 86 fa cd 35 |*.#:u.`.Q......5|
+Plaintext[32]:
+| 01 00 7f 53 b3 15 ba f5 87 c0 92 d5 85 b5 07 49 |...S...........I|
+| e9 b6 c7 ed 26 29 00 00 00 00 00 00 00 00 00 09 |....&)..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #289 (first time)
+ssl_session_init: initializing ptr 0x7f265a955d10 size 688
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 44218 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4458
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #291 (first time)
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 1155
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1069
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 329
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 315, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146
+ record: offset = 1146, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155
+
+dissect_ssl enter frame #293 (first time)
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c...
+looking for RSA pre-master00806b324308605bacc732ea33c19ec7b8087fc381371537...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| d8 c3 76 31 0f 6e 5e 17 17 0d d6 be f3 db c7 56 |..v1.n^........V|
+| 0b 70 fc 32 9b f8 d9 c0 6a 78 9c 5c 41 85 22 fc |.p.2....jx.\A.".|
+| 65 fb 64 c7 0d 87 4d e4 a3 14 a5 5d d7 92 c0 d1 |e.d...M....]....|
+| 6f a7 db a1 fd c3 11 de f1 df 75 02 dc fd de 38 |o.........u....8|
+| 5c c2 cc fe fb 0b 2f 24 39 0e 75 13 74 8b 46 9f |\...../$9.u.t.F.|
+| 2e 5b 19 fb 2d 28 ee 43 a9 26 33 b1 5e 84 46 f5 |.[..-(.C.&3.^.F.|
+| d3 bc 79 2d cf e6 8e ba |..y-.... |
+Client MAC key[20]:
+| d8 c3 76 31 0f 6e 5e 17 17 0d d6 be f3 db c7 56 |..v1.n^........V|
+| 0b 70 fc 32 |.p.2 |
+Server MAC key[20]:
+| 9b f8 d9 c0 6a 78 9c 5c 41 85 22 fc 65 fb 64 c7 |....jx.\A.".e.d.|
+| 0d 87 4d e4 |..M. |
+Client Write key[16]:
+| a3 14 a5 5d d7 92 c0 d1 6f a7 db a1 fd c3 11 de |...]....o.......|
+Server Write key[16]:
+| f1 df 75 02 dc fd de 38 5c c2 cc fe fb 0b 2f 24 |..u....8\...../$|
+Client Write IV[16]:
+| 39 0e 75 13 74 8b 46 9f 2e 5b 19 fb 2d 28 ee 43 |9.u.t.F..[..-(.C|
+Server Write IV[16]:
+| a9 26 33 b1 5e 84 46 f5 d3 bc 79 2d cf e6 8e ba |.&3.^.F...y-....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 3f cb 22 9b cd ff 5b 89 70 22 db 6e 16 3b 5c ce |?."...[.p".n.;\.|
+| 04 8f 6b 91 71 e7 c7 f3 ab 3b 88 c2 34 33 e6 62 |..k.q....;..43.b|
+ssl_save_session stored master secret[48]:
+| 53 c1 3c 3c 1c 13 17 08 f3 42 06 43 bb 7b fe 1e |S.<<.....B.C.{..|
+| c0 1d ac 21 0d 7f ed 48 d5 0c 56 15 6c d3 58 e9 |...!...H..V.l.X.|
+| a2 84 cb 8d 6c 3b ba 70 aa 86 a5 4f c4 dc 23 12 |....l;.p...O..#.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 5c 14 fd 1d 19 09 95 af 69 e4 7b 15 09 d1 65 71 |\.......i.{...eq|
+| 0b 3b bd 41 a3 d3 0c 2d f3 8e f1 ed bb 7b d7 ba |.;.A...-.....{..|
+| bf f8 06 a1 2e fb 78 74 a8 f4 f0 39 a7 23 64 b9 |......xt...9.#d.|
+| 80 7e db 8b 1c a2 49 85 94 65 cd 42 39 06 42 e1 |.~....I..e.B9.B.|
+Plaintext[64]:
+| 14 00 00 24 c0 f7 36 17 2b 44 f5 60 05 a5 c1 39 |...$..6.+D.`...9|
+| 77 82 1c 24 f5 d6 c8 5a 1e da 79 00 89 9f fd 07 |w..$...Z..y.....|
+| 54 fe 0f 67 b6 d2 82 b0 83 b8 50 b6 34 2a 08 3a |T..g......P.4*.:|
+| 4c 3a b1 75 41 c3 ce 00 5f 9b 14 00 00 00 00 03 |L:.uA..._.......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #294 (first time)
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| bb a5 41 fa f3 58 17 f4 ab fa 4f 4c 64 5d 22 df |..A..X....OLd]".|
+| 7f ed b6 c7 ab d2 6b cb 34 fe 1e bc 1c 18 c1 2f |......k.4....../|
+| fa 9b 33 c6 9c f9 80 39 01 5f c6 40 32 8a 46 6b |..3....9._.@2.Fk|
+| 3d 6e 83 54 aa 64 82 38 4a 13 fc c2 de 08 04 46 |=n.T.d.8J......F|
+Plaintext[64]:
+| 14 00 00 24 81 a9 13 a0 08 5f 49 8f 04 41 4a 8d |...$....._I..AJ.|
+| 28 96 95 4e 05 55 be 19 2f b7 08 ae 5d bc 97 af |(..N.U../...]...|
+| 40 33 a5 cf 17 62 26 25 43 35 0c 15 1a b2 f3 e0 |@3...b&%C5......|
+| e9 5e 1f 84 ea 2e 62 2e cd fb b9 90 00 00 00 03 |.^....b.........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #295 (first time)
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 76 96 3f 57 84 55 2f cc e9 c4 ca 19 26 f4 cf 5c |v.?W.U/.....&..\|
+| 17 75 47 44 77 6d 83 af 95 39 96 6f 85 bc 31 50 |.uGDwm...9.o..1P|
+Plaintext[32]:
+| 41 9a 69 f5 e2 0a e8 90 6d 1c 95 cd 06 4e 00 20 |A.i.....m....N. |
+| e0 3b 7a 59 00 00 00 00 00 00 00 00 00 00 00 0b |.;zY............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 44218 found (nil)
+association_find: TCP port 4458 found 0x3354fd0
+ record: offset = 37, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 74 2c d6 c9 77 03 99 73 e1 ed 65 33 17 e6 ae 64 |t,..w..s..e3...d|
+| 6a a4 3f 9b 46 26 86 10 44 43 d7 17 40 49 03 c5 |j.?.F&..DC..@I..|
+| 92 8a f0 75 42 f2 ba cf c8 97 a4 00 90 db c4 d2 |...uB...........|
+| ad 2d 1b ca 2d ea dc af 0d 37 87 9b b6 90 c1 65 |.-..-....7.....e|
+| 14 bf 57 f6 08 87 78 e1 19 73 c2 0d e6 df 97 c1 |..W...x..s......|
+| b0 ed ed f4 d5 3e 1f cb ff 3f e4 03 11 ca 8b eb |.....>...?......|
+| 1f 42 dd 96 b5 d0 33 4a da cf fa 33 d3 47 2b 93 |.B....3J...3.G+.|
+Plaintext[112]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a f3 3f 7e |n.nl:4458.....?~|
+| 1b 94 6f 38 2f f8 70 47 1d 46 31 6c 46 4a d1 d6 |..o8/.pG.F1lFJ..|
+| 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................|
+ssl_decrypt_record found padding 14 final len 97
+checking mac (len 77, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77
+association_find: TCP port 44218 found (nil)
+association_find: TCP port 4458 found 0x3354fd0
+dissect_ssl3_record decrypted len 77
+decrypted app data fragment[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a |n.nl:4458.... |
+dissect_ssl3_record found association 0x3354fd0
+
+dissect_ssl enter frame #296 (first time)
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 3b c8 e9 06 21 77 79 8c fc cc 27 7f 3c cb d0 dc |;...!wy...'.<...|
+| 08 e1 7d e4 2e 8f 5e c5 e3 6f 8f 85 be c5 10 42 |..}...^..o.....B|
+Plaintext[32]:
+| 01 00 96 2f 1a 74 e0 ee 9a 62 02 05 da dd 0d 66 |.../.t...b.....f|
+| 36 77 93 e2 71 b3 00 00 00 00 00 00 00 00 00 09 |6w..q...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #297 (first time)
+ conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 7d d2 26 10 8c 7a fe d6 0c 1d f1 3f eb 83 13 fd |}.&..z.....?....|
+| 88 07 47 6b 7e 36 f0 c1 34 b2 f2 a5 de ff 19 4f |..Gk~6..4......O|
+| ef 85 a2 39 77 d6 06 00 dc 93 1f 8e cc 43 0c 2a |...9w........C.*|
+| 8b 53 de 52 02 c1 e1 1f 97 ba 46 bb ea d3 94 ab |.S.R......F.....|
+| c5 2e 04 e2 9a ad 81 74 35 fd f1 63 ff 7a a6 47 |.......t5..c.z.G|
+| 3a 41 34 02 e7 f3 80 98 53 aa 87 89 d5 b5 34 76 |:A4.....S.....4v|
+| c5 1b 25 6c cc b4 f2 33 bf 0d 64 85 c9 00 d3 5e |..%l...3..d....^|
+| 59 0b e5 59 4d d1 20 5d 15 c2 0f 59 74 86 2d a5 |Y..YM. ]...Yt.-.|
+| 3d 85 cc dc 1d 48 38 c0 18 7b 71 6a 02 81 ea 06 |=....H8..{qj....|
+| e7 fb a2 db ae ec 1b af 3f 59 ee 2e 85 e3 6d 15 |........?Y....m.|
+| 72 4a b0 96 b6 28 89 ca c2 af 8c ab 53 5a 38 4d |rJ...(......SZ8M|
+| f5 11 c9 25 88 72 25 6f 82 0d 93 54 0c 8b 95 9f |...%.r%o...T....|
+| 32 8b a1 0f d5 97 36 4d 29 66 cf a1 2e a8 56 ec |2.....6M)f....V.|
+| b6 b6 12 f3 ea ea 2c b5 76 08 11 6a 0b 26 dc b3 |......,.v..j.&..|
+| 80 eb 3e 62 d3 73 1e 84 75 ed 04 b1 06 48 24 8f |..>b.s..u....H$.|
+| 9d c8 54 93 f0 9a 64 0f af 42 d7 fb 4b 4b ac be |..T...d..B..KK..|
+| 5f 52 2a c5 b6 b5 55 5d a1 73 6b 8d b6 71 f0 1f |_R*...U].sk..q..|
+| 34 82 df 06 58 ed de ec ae c8 20 47 66 3e 17 45 |4...X..... Gf>.E|
+| e6 da aa 4f b2 1b 10 4e 2f bb 0f 62 b7 d9 ce 7f |...O...N/..b....|
+| a4 ab b9 2d 3b 76 d7 6f a9 39 b4 fd bb 78 89 8f |...-;v.o.9...x..|
+| bf 85 33 3d ae c3 65 2d b4 21 ee 62 f2 a7 4d 6e |..3=..e-.!.b..Mn|
+| 75 4f ea 65 2b d8 b7 a8 c8 98 e8 58 0f 7c 7e 4f |uO.e+......X.|~O|
+| 4c 19 3e 4f 0d f3 a1 e3 e6 2a ce fd 59 2c dc e5 |L.>O.....*..Y,..|
+| 9c 36 b0 fb 90 19 98 75 28 eb f7 05 e9 23 2c d2 |.6.....u(....#,.|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| cb c6 a8 b7 9a 1b 59 13 85 e7 f9 44 eb 33 06 f2 |......Y....D.3..|
+| bc bb e1 a7 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 372
+checking mac (len 352, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352
+association_find: TCP port 4458 found 0x3354fd0
+dissect_ssl3_record decrypted len 352
+decrypted app data fragment[352]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+dissect_ssl3_record found association 0x3354fd0
+
+dissect_ssl enter frame #302 (first time)
+ssl_session_init: initializing ptr 0x7f265a958080 size 688
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 45099 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4459
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #304 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #306 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d...
+looking for RSA pre-master0080b798eaf6f599d1530d69d93f5c3c464d9afc1d714667...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 82 24 dc f7 08 9a a6 b5 2a 53 33 12 07 fe bd ec |.$......*S3.....|
+| 01 0c 06 b3 20 78 6e b7 af 8b c5 11 5d 07 91 42 |.... xn.....]..B|
+| 6c e3 28 cd 37 9f 92 dc 1c cf 50 b9 dd 2e ff 45 |l.(.7.....P....E|
+| 7d 42 f8 46 61 65 b9 bb da d3 fe a5 59 87 30 e3 |}B.Fae......Y.0.|
+| f2 e9 43 5c 24 bb d1 89 1b fb 7d 9e 05 28 e4 f9 |..C\$.....}..(..|
+| 1b 67 07 2f a7 d4 9f f6 45 25 e3 a6 fe 06 cb 33 |.g./....E%.....3|
+| aa ed 48 fc c2 35 51 11 |..H..5Q. |
+Client MAC key[20]:
+| 82 24 dc f7 08 9a a6 b5 2a 53 33 12 07 fe bd ec |.$......*S3.....|
+| 01 0c 06 b3 |.... |
+Server MAC key[20]:
+| 20 78 6e b7 af 8b c5 11 5d 07 91 42 6c e3 28 cd | xn.....]..Bl.(.|
+| 37 9f 92 dc |7... |
+Client Write key[16]:
+| 1c cf 50 b9 dd 2e ff 45 7d 42 f8 46 61 65 b9 bb |..P....E}B.Fae..|
+Server Write key[16]:
+| da d3 fe a5 59 87 30 e3 f2 e9 43 5c 24 bb d1 89 |....Y.0...C\$...|
+Client Write IV[16]:
+| 1b fb 7d 9e 05 28 e4 f9 1b 67 07 2f a7 d4 9f f6 |..}..(...g./....|
+Server Write IV[16]:
+| 45 25 e3 a6 fe 06 cb 33 aa ed 48 fc c2 35 51 11 |E%.....3..H..5Q.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 37 6d 2c 1d b6 bd f2 44 60 6f 0d 39 91 e2 f2 60 |7m,....D`o.9...`|
+| b6 ac dc 88 a7 0b 83 b5 b5 4d 1f ea 6a f8 b5 c6 |.........M..j...|
+ssl_save_session stored master secret[48]:
+| 65 cc 16 42 59 70 2e 78 48 9f 6c 4f 9f 3f d2 b3 |e..BYp.xH.lO.?..|
+| ab f9 fc 5d bc 43 e7 59 2f 76 70 f8 78 0d e9 f3 |...].C.Y/vp.x...|
+| 3b 20 5d dc b4 59 02 b8 cc af 48 b5 9a 80 b9 ac |; ]..Y....H.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 59 17 37 d7 0a f6 48 f9 38 0c 21 cf be 46 c4 62 |Y.7...H.8.!..F.b|
+| e7 1a 67 f4 86 ff 17 e8 fa b7 0b 4f 6a 6e 4b f5 |..g........OjnK.|
+| 68 30 49 31 07 3a 7c 29 2b 0f e0 69 46 66 f2 aa |h0I1.:|)+..iFf..|
+| fd 8f a9 58 bf 2f 6e 70 88 40 5a d4 ac 22 d5 20 |...X./np.@Z..". |
+Plaintext[64]:
+| 14 00 00 24 0c 82 76 88 55 cd 40 8a 0d 91 a5 c8 |...$..v.U.@.....|
+| 94 43 24 79 a3 6d 92 73 f8 54 5e ae 9e 66 0e 88 |.C$y.m.s.T^..f..|
+| 30 c7 9a 4b 17 91 90 98 9b a2 db 67 67 49 d6 1e |0..K.......ggI..|
+| 54 19 4c 40 36 56 0c 37 e1 ea 3a 04 00 00 00 03 |T.L@6V.7..:.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #307 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 04 dc 2a 0f bd 9b a7 af fe 02 86 2f ca 8f 47 8d |..*......../..G.|
+| e9 81 0b 5a 80 a4 77 ca bc eb 1d a9 c7 1b 8a 84 |...Z..w.........|
+| 6f 00 69 68 e3 98 f8 55 49 e5 e7 8c e0 37 e5 bf |o.ih...UI....7..|
+| 28 bb e2 0b 3c a5 c2 8c bc de ac 4b 17 b6 6e a0 |(...<......K..n.|
+Plaintext[64]:
+| 14 00 00 24 4a a6 19 c3 07 22 31 e4 de 31 fe 58 |...$J...."1..1.X|
+| 01 10 8a 83 a7 b1 91 ed 41 2a 37 4a fa 2f 79 be |........A*7J./y.|
+| 01 84 8e 57 5c 69 07 fe d5 e3 20 f7 72 dd 3e 53 |...W\i.... .r.>S|
+| 9e c7 59 d8 24 51 bf 33 60 f5 7a 8e 00 00 00 03 |..Y.$Q.3`.z.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #308 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 1c 2f ac ee a2 b8 92 e1 8c 47 41 83 99 14 41 d0 |./.......GA...A.|
+| 20 4c 6b 31 06 84 7e 96 30 98 85 7d 29 74 c5 e3 | Lk1..~.0..})t..|
+Plaintext[32]:
+| 18 ac e1 a0 a9 c4 85 a6 e3 48 de a9 bc b3 c5 a8 |.........H......|
+| 7b fa 07 05 00 00 00 00 00 00 00 00 00 00 00 0b |{...............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 45099 found (nil)
+association_find: TCP port 4459 found 0x3355860
+ record: offset = 37, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 0f e6 3a 23 f4 e1 e9 c8 d4 e2 77 fd a1 fa 79 20 |..:#......w...y |
+| 75 e0 36 8b 45 d4 13 d0 a7 b3 e1 02 54 98 4d 44 |u.6.E.......T.MD|
+| 4a f2 a3 da 1b ae c1 e3 c7 ed d8 ba 42 c8 3b 2f |J...........B.;/|
+| 27 c9 98 98 0a 4a bb ae f4 a7 59 cc 08 be 04 66 |'....J....Y....f|
+| 05 c5 45 dc 4e 5f 39 f2 2e ec 0a 82 5e db a6 1b |..E.N_9.....^...|
+| 22 19 cb e5 b7 d7 e2 6d 3c 11 cc 9e 39 20 dd 69 |"......m<...9 .i|
+| d3 d2 2c 57 d2 0f e2 04 c0 b6 d8 f2 c9 a8 54 bb |..,W..........T.|
+Plaintext[112]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a d2 83 1a |n.nl:4459.......|
+| 61 3d 07 a0 13 a0 88 d1 33 e0 86 c3 60 85 16 48 |a=......3...`..H|
+| 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |[...............|
+ssl_decrypt_record found padding 14 final len 97
+checking mac (len 77, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77
+association_find: TCP port 45099 found (nil)
+association_find: TCP port 4459 found 0x3355860
+dissect_ssl3_record decrypted len 77
+decrypted app data fragment[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a |n.nl:4459.... |
+dissect_ssl3_record found association 0x3355860
+
+dissect_ssl enter frame #309 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 4d 1c b4 32 d3 8d 35 17 f2 ae 52 52 1a 3b 11 95 |M..2..5...RR.;..|
+| c8 6c cc 6f 01 8c 1b 38 43 ea d6 ba 48 05 02 5d |.l.o...8C...H..]|
+| cc 20 48 15 f5 2d fe 50 3c 54 6b 40 9d 8e a6 bf |. H..-.P<Tk@....|
+| b1 44 f7 c4 65 d6 45 05 49 f3 a0 ab 5c 4f c2 78 |.D..e.E.I...\O.x|
+| d1 53 5d 32 cf 45 a2 2b e1 1e 84 df 80 38 f6 36 |.S]2.E.+.....8.6|
+| f7 7e 74 02 93 69 bd f7 39 74 17 5a 74 dc 1a c0 |.~t..i..9t.Zt...|
+| f1 65 de b9 84 c2 33 ec 0c 09 27 d7 47 29 0f b6 |.e....3...'.G)..|
+| 61 f6 f8 e4 46 a7 2c cf de 52 6b fe c3 c2 24 8c |a...F.,..Rk...$.|
+| 9b f8 98 07 1f 9c 33 24 91 33 4c 77 70 76 7b da |......3$.3Lwpv{.|
+| 96 c1 cc 4a 88 e4 a4 e2 6b 72 a1 82 a3 28 90 40 |...J....kr...(.@|
+| 1b 2a 39 61 e1 68 aa 76 45 63 e9 a0 16 b8 28 b9 |.*9a.h.vEc....(.|
+| 8a 79 6f cd ee 6a f1 dd 6b 5f bd 64 1e fc 0c 99 |.yo..j..k_.d....|
+| a8 e5 55 be 57 fc 23 aa 23 4a 31 5d c9 c8 92 23 |..U.W.#.#J1]...#|
+| 67 ce e2 16 82 3a 13 1e b8 16 e5 73 4a fc ae 01 |g....:.....sJ...|
+| 2b e8 74 ba 0c 5b 1a cb e0 a7 fb b9 33 76 54 27 |+.t..[......3vT'|
+| 38 a6 e8 e8 3a 86 24 31 f3 9b b9 23 ad d0 d5 90 |8...:.$1...#....|
+| 05 d5 db 80 14 d4 83 d9 78 00 03 a4 17 01 5e 0d |........x.....^.|
+| c7 22 b8 18 91 0c 17 44 a4 e2 39 d0 10 92 b6 7f |.".....D..9.....|
+| 41 d6 0c 28 99 59 23 0d 04 14 8b f4 c5 db 3b a0 |A..(.Y#.......;.|
+| e4 90 88 cb a4 82 6c 27 14 ce 31 c5 40 23 c4 80 |......l'..1.@#..|
+| ae e7 64 ae 54 02 8c 9c 6c ae 2e cd de ad ab b4 |..d.T...l.......|
+| 53 fe 7d a1 fa be 97 81 ff 5a 6d 31 dc 1c 9b 02 |S.}......Zm1....|
+| d3 36 2d 21 20 44 d0 06 74 69 9b b4 92 1b a4 e1 |.6-! D..ti......|
+| f9 93 aa f6 2a 74 40 27 60 ec b0 ae 5d fe 47 e0 |....*t@'`...].G.|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| a7 fc 1c 5a f9 3b a7 b1 3f 2a 6b 21 54 69 e4 eb |...Z.;..?*k!Ti..|
+| 4e eb 6c 4b 00 00 00 00 00 00 00 00 00 00 00 0b |N.lK............|
+ssl_decrypt_record found padding 11 final len 372
+checking mac (len 352, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352
+association_find: TCP port 4459 found 0x3355860
+dissect_ssl3_record decrypted len 352
+decrypted app data fragment[352]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+dissect_ssl3_record found association 0x3355860
+
+dissect_ssl enter frame #310 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| cf b8 ca bd a3 1f f3 22 06 c0 bb 62 fd 9c f0 e8 |......."...b....|
+| 22 c1 81 23 87 c5 ab 55 45 99 2f 03 8e a7 1b 8f |"..#...UE./.....|
+Plaintext[32]:
+| 01 00 75 dc 97 b5 4c de 24 e9 f9 8e 48 52 91 f5 |..u...L.$...HR..|
+| 82 4e c4 4b 1c 5d 00 00 00 00 00 00 00 00 00 09 |.N.K.]..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #312 (first time)
+ conversation = 0x7f2686946260, ssl_session = 0x7f265a958080
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| b4 2e 17 e5 21 85 86 17 c2 16 19 0d 5d 46 10 38 |....!.......]F.8|
+| 8e 81 e2 4e 6b 0d c5 42 0d 7f 0b e8 ea 64 26 2b |...Nk..B.....d&+|
+Plaintext[32]:
+| 01 00 52 6b dd 81 88 a8 72 a2 ce 16 f9 05 b4 dc |..Rk....r.......|
+| 3d ff 0c 11 ce 79 00 00 00 00 00 00 00 00 00 09 |=....y..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #317 (first time)
+ssl_session_init: initializing ptr 0x7f265a95a870 size 688
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 45432 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4463
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #319 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #321 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf538198...
+looking for RSA pre-master15284a4d462ec1be6f154a748d055c28f45a491e46bb5076...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| de c5 ee ad bf f0 b9 3f ab 69 cd 50 ba e7 36 0d |.......?.i.P..6.|
+| 7c 97 88 ca 7c 25 a7 40 4f d6 34 db 75 18 eb 93 ||...|%.@O.4.u...|
+| 58 7d 84 6f 60 a8 88 56 27 22 c0 d1 fb ae c6 9c |X}.o`..V'"......|
+| a6 a5 3a be 1f 77 67 ae 28 bb 5e 7d 6e 2e 4e ee |..:..wg.(.^}n.N.|
+| e8 39 f8 a6 ea b1 ee cf 47 d3 0c 42 eb 95 5d ad |.9......G..B..].|
+| 19 14 84 dd 02 8d 1d c2 52 dc 60 95 cd 93 e9 7b |........R.`....{|
+| c4 7d c1 6e 8e c4 cb 04 96 ce 85 13 cb 13 d6 67 |.}.n...........g|
+| 81 2c f5 60 50 5b 02 1b 4f 01 ad ef b8 6d ff c3 |.,.`P[..O....m..|
+| 2e 6c 80 58 67 0e 96 1e |.l.Xg... |
+Client MAC key[20]:
+| de c5 ee ad bf f0 b9 3f ab 69 cd 50 ba e7 36 0d |.......?.i.P..6.|
+| 7c 97 88 ca ||... |
+Server MAC key[20]:
+| 7c 25 a7 40 4f d6 34 db 75 18 eb 93 58 7d 84 6f ||%.@O.4.u...X}.o|
+| 60 a8 88 56 |`..V |
+Client Write key[32]:
+| 27 22 c0 d1 fb ae c6 9c a6 a5 3a be 1f 77 67 ae |'"........:..wg.|
+| 28 bb 5e 7d 6e 2e 4e ee e8 39 f8 a6 ea b1 ee cf |(.^}n.N..9......|
+Server Write key[32]:
+| 47 d3 0c 42 eb 95 5d ad 19 14 84 dd 02 8d 1d c2 |G..B..].........|
+| 52 dc 60 95 cd 93 e9 7b c4 7d c1 6e 8e c4 cb 04 |R.`....{.}.n....|
+Client Write IV[16]:
+| 96 ce 85 13 cb 13 d6 67 81 2c f5 60 50 5b 02 1b |.......g.,.`P[..|
+Server Write IV[16]:
+| 4f 01 ad ef b8 6d ff c3 2e 6c 80 58 67 0e 96 1e |O....m...l.Xg...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 7d a7 24 05 84 be 15 20 d4 89 1d f9 d9 96 57 26 |}.$.... ......W&|
+| db ff e3 64 b0 7f 6a d7 96 12 69 4e 6f 0a 07 be |...d..j...iNo...|
+ssl_save_session stored master secret[48]:
+| ea a7 77 66 75 b7 76 a5 00 b9 ff 42 7f 17 bb 1e |..wfu.v....B....|
+| 2e bd 14 f3 59 cc 35 4f e9 11 5b 75 0e c0 35 3e |....Y.5O..[u..5>|
+| 0b 6e c1 d3 81 e3 78 bc 16 25 fc 19 b2 2c c1 3b |.n....x..%...,.;|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 80 af 26 be b8 e9 8f c7 0a 76 a8 e2 06 ff a2 ab |..&......v......|
+| 67 f1 85 ad 9b 37 87 45 91 c4 01 a6 17 e2 1e 0d |g....7.E........|
+| af b5 45 ca e6 ab 05 7e 21 2b 53 b2 c5 1a 26 63 |..E....~!+S...&c|
+| 03 21 9e 48 38 f0 b2 3e 01 e2 a9 8e 05 5e 1b 26 |.!.H8..>.....^.&|
+Plaintext[64]:
+| 14 00 00 24 eb 6a 91 0a 42 fa 04 12 bd fe 4b 08 |...$.j..B.....K.|
+| 4b 2b 22 2c ff cc 25 d5 04 d4 ea 91 1b 00 50 ee |K+",..%.......P.|
+| eb bb 41 20 d2 3d 24 fd c8 0b 14 e5 da 34 09 a9 |..A .=$......4..|
+| 8b 41 fe a5 3e 54 28 23 f3 2d 00 ee 00 00 00 03 |.A..>T(#.-......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #322 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 7c a8 eb 79 ef 8e 85 f3 41 a0 2d 3b 21 c5 53 08 ||..y....A.-;!.S.|
+| 44 2a eb 3f e0 56 7b 02 d0 58 77 14 9b 3b c4 91 |D*.?.V{..Xw..;..|
+| 61 43 1e 80 e9 55 8f 3b 91 7f e3 70 11 4c a3 97 |aC...U.;...p.L..|
+| f0 aa 81 fb 87 53 6c eb 58 e5 9d 57 8b 4a ea 5c |.....Sl.X..W.J.\|
+Plaintext[64]:
+| 14 00 00 24 18 a0 af f2 db db da 25 ac 7e 3b 96 |...$.......%.~;.|
+| f7 d9 11 b0 72 da 44 14 df b0 d7 ba e7 e4 e8 f6 |....r.D.........|
+| 61 a4 8e 97 dd 8b b5 d3 81 ec 9a 2c 48 da 47 20 |a..........,H.G |
+| c7 50 52 f9 10 6d 28 7b 4f 7d a5 a0 00 00 00 03 |.PR..m({O}......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #323 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e8 d6 8d 9d fa d4 1c 75 f8 c0 5b 12 9c bd 70 c4 |.......u..[...p.|
+| e1 93 3e 93 cd 1c 4b 05 88 4e 5a 94 86 65 89 cc |..>...K..NZ..e..|
+Plaintext[32]:
+| 03 62 d4 65 70 ef 48 ee 1d 97 f5 6d 8c 87 09 b2 |.b.ep.H....m....|
+| 74 5c 65 6c 00 00 00 00 00 00 00 00 00 00 00 0b |t\el............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 45432 found (nil)
+association_find: TCP port 4463 found 0x33562c0
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 2e 80 d2 21 29 f7 18 eb 0c 8d ca 2d 24 eb b5 62 |...!)......-$..b|
+| dc 29 fe 0e 1c 40 56 f7 bd 6f a9 68 00 00 5b 75 |.)...@V..o.h..[u|
+| 50 2a b7 8a ea d6 90 5e 82 8a 44 4d 45 2f 9e 1e |P*.....^..DME/..|
+| d1 54 34 e9 e0 37 20 d9 1c f9 8b 62 01 bc af 35 |.T4..7 ....b...5|
+| 3a 6e 56 48 97 ac bd 7a 0b cf 0b 88 c0 e8 c6 38 |:nVH...z.......8|
+| 52 e7 e4 98 04 52 e8 91 22 54 55 ec 02 1e 6c 05 |R....R.."TU...l.|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25|
+| 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446|
+| 33 0d 0a 0d 0a 82 5a 88 2c 4c d4 94 88 18 c9 64 |3.....Z.,L.....d|
+| 91 eb bd 43 f3 9f 9a f1 28 00 00 00 00 00 00 06 |...C....(.......|
+ssl_decrypt_record found padding 6 final len 89
+checking mac (len 69, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 69, seq = 0, nxtseq = 69
+association_find: TCP port 45432 found (nil)
+association_find: TCP port 4463 found 0x33562c0
+dissect_ssl3_record decrypted len 69
+decrypted app data fragment[69]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25|
+| 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446|
+| 33 0d 0a 0d 0a |3.... |
+dissect_ssl3_record found association 0x33562c0
+
+dissect_ssl enter frame #324 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 44 a2 fb 7a 0e d8 02 6b 2b 51 65 ea 16 d3 ec 14 |D..z...k+Qe.....|
+| c5 23 a7 1d d2 22 15 bc 4e a3 9f 19 7b 69 3f 2a |.#..."..N...{i?*|
+| cf b7 86 57 ed 7c af 31 35 42 2d 5e 70 35 4d 9f |...W.|.15B-^p5M.|
+| 16 53 22 cb fa 47 49 18 1a 58 e7 a4 a5 b7 00 ac |.S"..GI..X......|
+| c5 05 ca 1a 49 46 19 e3 90 37 b6 8d 16 d7 3f 7d |....IF...7....?}|
+| fc 1d c1 f5 5c 0c a8 84 81 2e fd 3f fc 6f 15 49 |....\......?.o.I|
+| 84 6a 85 7d a0 d9 69 ec a0 a4 15 36 79 96 2d 08 |.j.}..i....6y.-.|
+| 16 0c d1 97 3c 50 d8 89 2a c4 11 14 17 a3 a3 40 |....<P..*......@|
+| 01 0a 0c 9b 5d 0e 18 a3 f0 cc 9a 31 69 35 aa 9e |....]......1i5..|
+| fb ad d1 2c 13 5f b0 c4 ce a6 a4 ba 6e fb b9 11 |...,._......n...|
+| 37 ec 5a c7 1a 88 91 b3 ff 07 e3 a4 7b 8f 8e c3 |7.Z.........{...|
+| 3d 2b 45 90 90 1b f9 8b f8 a3 b3 b6 fc ed d2 54 |=+E............T|
+| 47 38 04 d1 db 44 fc c0 ac 6b 46 8c 5a 95 7c d3 |G8...D...kF.Z.|.|
+| 5d 1d 09 54 10 22 73 ff 2c be 99 44 98 73 85 42 |]..T."s.,..D.s.B|
+| bb f3 e1 b6 e7 9c dc a4 93 be 44 9e 1e c9 77 2a |..........D...w*|
+| b4 a0 58 07 7e 10 54 e1 6f 30 e4 a2 a4 6e 12 8b |..X.~.T.o0...n..|
+| e7 9d e1 f1 72 9e e9 00 5c c4 d0 1e 92 9c 8e 68 |....r...\......h|
+| ca a0 bf 06 78 2c e8 b6 e7 58 17 29 ab 69 ae 03 |....x,...X.).i..|
+| c5 9f 66 da 2f e5 3d e4 f0 f6 e8 82 46 f6 8e 38 |..f./.=.....F..8|
+| 65 cb 3f e9 f3 c8 51 03 ac aa 86 c9 dc f6 71 db |e.?...Q.......q.|
+| 60 3e 51 26 dd a3 85 f7 fd 59 1b 63 31 c9 9c e4 |`>Q&.....Y.c1...|
+| dd 33 e8 54 22 f5 f5 50 1c 1a 96 3d 66 27 d2 10 |.3.T"..P...=f'..|
+| 5b d6 d3 2a f4 37 b8 a6 f4 e7 8b 87 65 5c 58 4a |[..*.7......e\XJ|
+| a8 97 77 de 54 bb e1 42 62 cc 48 4b 69 98 e9 c1 |..w.T..Bb.HKi...|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL|
+| 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 76 76 f9 0f 2a 8f a6 00 c0 c1 6f 74 94 64 4a de |vv..*.....ot.dJ.|
+| 9c 6d 6c 26 00 00 00 00 00 00 00 00 00 00 00 0b |.ml&............|
+ssl_decrypt_record found padding 11 final len 372
+checking mac (len 352, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352
+association_find: TCP port 4463 found 0x33562c0
+dissect_ssl3_record decrypted len 352
+decrypted app data fragment[352]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL|
+| 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+dissect_ssl3_record found association 0x33562c0
+
+dissect_ssl enter frame #325 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d0 c6 65 92 99 12 9a d2 ae cf 68 de 7a 37 84 5d |..e.......h.z7.]|
+| ae be 5e 9e 60 b9 5f 16 c8 6c 9f 51 8e 00 b1 c7 |..^.`._..l.Q....|
+Plaintext[32]:
+| 01 00 ff 84 89 d3 26 30 e0 a4 cf 91 19 e3 f0 8b |......&0........|
+| 99 de 09 aa ff 03 00 00 00 00 00 00 00 00 00 09 |................|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #327 (first time)
+ conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ae 60 16 c0 e8 8c 61 9a 3f 1d 0a 16 8b 6a 4a f1 |.`....a.?....jJ.|
+| 05 b0 19 b8 67 43 e8 c9 ae 18 d3 70 a3 b6 9b be |....gC.....p....|
+Plaintext[32]:
+| 01 00 99 b0 f8 5f ea a4 e2 31 ab 59 5d 43 02 a3 |....._...1.Y]C..|
+| 83 f8 f2 90 5e 9a 00 00 00 00 00 00 00 00 00 09 |....^...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #332 (first time)
+ssl_session_init: initializing ptr 0x7f265a95d0a0 size 688
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 45966 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4464
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #334 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 1155
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1069
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 329
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 315, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146
+ record: offset = 1146, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155
+
+dissect_ssl enter frame #336 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d...
+looking for RSA pre-master00809f76b66ed3ebe0b5f825182ea59988fed580b483d955...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| dd b5 c7 cf 52 be ea 77 63 d4 ea ef 6f f7 76 1d |....R..wc...o.v.|
+| 04 55 06 7b e8 51 5b b0 de 10 1d fe 51 84 3c c7 |.U.{.Q[.....Q.<.|
+| 91 48 8a ec 7e 53 30 48 9d 1b 83 4b d1 59 f9 76 |.H..~S0H...K.Y.v|
+| 1d 31 a2 37 81 38 cf dd f0 95 cb 3f 21 80 6c de |.1.7.8.....?!.l.|
+| 63 9c 0b 3c 0b f1 6e bd 98 96 1e 41 e0 6a 2a 8b |c..<..n....A.j*.|
+| da fc ee dc 42 6d a0 a8 e0 b8 2c c2 8e c6 f1 8e |....Bm....,.....|
+| 38 fd a6 b5 8e b8 83 4f 80 c2 42 1e 6b 19 86 2a |8......O..B.k..*|
+| 73 26 7e f7 db f1 ab 7e d7 1b 1a 01 3b fc 9e c1 |s&~....~....;...|
+| ae 8b cd f3 c3 ae 82 a8 |........ |
+Client MAC key[20]:
+| dd b5 c7 cf 52 be ea 77 63 d4 ea ef 6f f7 76 1d |....R..wc...o.v.|
+| 04 55 06 7b |.U.{ |
+Server MAC key[20]:
+| e8 51 5b b0 de 10 1d fe 51 84 3c c7 91 48 8a ec |.Q[.....Q.<..H..|
+| 7e 53 30 48 |~S0H |
+Client Write key[32]:
+| 9d 1b 83 4b d1 59 f9 76 1d 31 a2 37 81 38 cf dd |...K.Y.v.1.7.8..|
+| f0 95 cb 3f 21 80 6c de 63 9c 0b 3c 0b f1 6e bd |...?!.l.c..<..n.|
+Server Write key[32]:
+| 98 96 1e 41 e0 6a 2a 8b da fc ee dc 42 6d a0 a8 |...A.j*.....Bm..|
+| e0 b8 2c c2 8e c6 f1 8e 38 fd a6 b5 8e b8 83 4f |..,.....8......O|
+Client Write IV[16]:
+| 80 c2 42 1e 6b 19 86 2a 73 26 7e f7 db f1 ab 7e |..B.k..*s&~....~|
+Server Write IV[16]:
+| d7 1b 1a 01 3b fc 9e c1 ae 8b cd f3 c3 ae 82 a8 |....;...........|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 15 c3 09 9d 21 38 e5 80 b6 06 0c 20 36 d8 84 72 |....!8..... 6..r|
+| d6 70 b4 ec 67 9f ba 45 39 1c 83 1b 4f ce 49 ec |.p..g..E9...O.I.|
+ssl_save_session stored master secret[48]:
+| b6 a7 ac 05 2e 39 e4 62 5d 52 85 c8 62 c0 4a 31 |.....9.b]R..b.J1|
+| 98 50 4c 0b 45 ea c7 12 3b fe a2 25 f9 22 50 e8 |.PL.E...;..%."P.|
+| 8a 5a 8d 97 cd 9d c0 7e 80 db 2d 2f 8b ce 35 55 |.Z.....~..-/..5U|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| d5 77 ec ae 91 55 3c 7b 94 50 4d b1 9a 35 5f c8 |.w...U<{.PM..5_.|
+| 3b 78 8f 25 58 d6 92 b4 1f 91 e2 6b 18 34 2f 9f |;x.%X......k.4/.|
+| 1a b7 ce 49 93 0d 0d bf e6 3c 81 e8 08 37 29 78 |...I.....<...7)x|
+| d3 b9 e6 5f 43 ca 76 02 a5 9d af ed e1 83 ca df |..._C.v.........|
+Plaintext[64]:
+| 14 00 00 24 4d f0 59 84 6f f7 26 00 5a a4 1f 7f |...$M.Y.o.&.Z...|
+| 3b 48 86 37 44 8b 6e f0 2d a5 a4 76 fb 86 9b f9 |;H.7D.n.-..v....|
+| 85 ef ec 1e 98 2e 1c ad 60 c7 54 3e 5c 72 3d 8b |........`.T>\r=.|
+| 36 c3 83 b7 7e 0f a8 ff 96 e3 5a 49 00 00 00 03 |6...~.....ZI....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #337 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fe c7 29 46 75 dd 0a 06 8c e4 60 ee bf 9b 1a c0 |..)Fu.....`.....|
+| 68 c0 15 fd 00 1f 4b 13 04 b9 09 a2 21 39 5a 55 |h.....K.....!9ZU|
+| 34 5a a8 7a c9 15 2e 8b d0 23 b7 b2 c8 f5 3b ed |4Z.z.....#....;.|
+| af 76 51 83 d1 d7 73 9f d1 b4 62 c6 54 a4 f2 54 |.vQ...s...b.T..T|
+Plaintext[64]:
+| 14 00 00 24 c4 cd 3a ea fe 93 ea 0f 58 46 9e b6 |...$..:.....XF..|
+| 15 55 ec a5 4b c0 a3 e8 b0 8d 0d 51 29 4f 1c 10 |.U..K......Q)O..|
+| f7 6c c7 71 85 a9 3a bc a7 32 f2 0b 3e 69 e4 58 |.l.q..:..2..>i.X|
+| 1f a6 85 10 a8 17 bf a8 4b 76 77 02 00 00 00 03 |........Kvw.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #338 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 8a c7 aa a2 41 cf f2 b9 7a 45 c8 2b f4 8c 6e 41 |....A...zE.+..nA|
+| 20 74 dc 68 18 75 e4 fd a1 0a e7 d9 aa b7 7a 21 | t.h.u........z!|
+Plaintext[32]:
+| 46 8e ec ac f6 8e 5a 58 38 09 a5 8c e5 b4 e2 71 |F.....ZX8......q|
+| 73 79 d8 e3 00 00 00 00 00 00 00 00 00 00 00 0b |sy..............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 45966 found (nil)
+association_find: TCP port 4464 found 0x33faac0
+ record: offset = 37, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 8d fb cb 8c 85 da 94 7e 1c a6 67 68 95 22 aa f8 |.......~..gh."..|
+| 28 2f 83 b2 72 9a ba d3 61 ef 5c 28 d4 8f 5e c2 |(/..r...a.\(..^.|
+| e9 87 a9 9c c7 97 fc 9f 19 3f 46 f2 98 08 83 2d |.........?F....-|
+| 85 03 48 86 1f b0 47 75 aa c4 ca 68 8e e2 7c 12 |..H...Gu...h..|.|
+| 67 01 7f 49 cd 09 f8 52 ef 84 2e ec e5 ee 98 85 |g..I...R........|
+| ea 51 8f 09 2c 61 12 b8 1d aa 9b 00 84 5c 37 26 |.Q..,a.......\7&|
+| 09 a1 91 2b 27 9c eb 1f ce 1e 50 fd 7f 73 04 37 |...+'.....P..s.7|
+Plaintext[112]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a 6f 4e 67 |n.nl:4464....oNg|
+| c0 7f 6f 3d 69 f5 24 1d d0 0b 7f 6a f9 56 d6 a9 |..o=i.$....j.V..|
+| f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................|
+ssl_decrypt_record found padding 14 final len 97
+checking mac (len 77, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77
+association_find: TCP port 45966 found (nil)
+association_find: TCP port 4464 found 0x33faac0
+dissect_ssl3_record decrypted len 77
+decrypted app data fragment[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a |n.nl:4464.... |
+dissect_ssl3_record found association 0x33faac0
+
+dissect_ssl enter frame #339 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| de 24 94 be fd e1 ac 9d 66 9e 37 bd 67 0f f9 4f |.$......f.7.g..O|
+| e4 0e 20 eb 7a 24 4c 5f 09 67 6b ca c8 d3 76 c4 |.. .z$L_.gk...v.|
+| d3 2d be 0b a3 5e 5d 62 e9 ed 36 d0 10 f2 5c 7b |.-...^]b..6...\{|
+| d7 f3 ff e2 d8 62 9d 00 8f 97 db d0 cf 5f e2 8f |.....b......._..|
+| 1f d3 18 e9 d6 ab 41 08 45 02 f0 92 b6 39 d3 3a |......A.E....9.:|
+| ac 24 7f fa 9a 10 18 2e a7 eb 89 b0 00 2e 23 3c |.$............#<|
+| ed 95 d5 40 8d e5 4e 38 e1 2a df 0c 2b ca 53 f9 |...@..N8.*..+.S.|
+| 90 14 bb e3 af 0b e5 8e 3f a9 8c db 89 56 3e ec |........?....V>.|
+| 9a 4b 69 b3 e2 ed c9 12 87 b9 9d 47 30 30 b3 be |.Ki........G00..|
+| e2 9e 6a 36 30 b9 e4 21 85 80 fc 7c 5b ea 7c d5 |..j60..!...|[.|.|
+| a2 21 22 77 84 6d c1 9a c9 58 d9 7d 6c 49 cb aa |.!"w.m...X.}lI..|
+| 95 d6 b7 e0 ed 6d ce d3 cc 02 d0 dd d4 d9 91 42 |.....m.........B|
+| d2 38 ee e9 1c 89 8b c4 04 f3 0e 15 57 15 c5 05 |.8..........W...|
+| 7b 82 ff da 94 d2 5a 31 98 fa c8 c9 7e ff 20 1c |{.....Z1....~. .|
+| fe 93 3d 96 1b fa 85 4f a5 60 40 63 8d a5 b7 a2 |..=....O.`@c....|
+| 1e d7 f2 55 87 c9 84 71 c9 5d 74 84 7b b1 b4 02 |...U...q.]t.{...|
+| 6b bc 06 59 11 24 4e ff c7 b3 67 69 cf a0 8b 15 |k..Y.$N...gi....|
+| 67 00 b9 23 d0 54 7f 12 4d 07 15 8a e9 d4 c8 c3 |g..#.T..M.......|
+| ed 37 3c f2 00 cf 0f 96 cd f3 46 43 34 04 ac eb |.7<.......FC4...|
+| 16 a0 85 58 8b 6f bf bd 74 a4 00 86 85 81 26 ca |...X.o..t.....&.|
+| cb e9 ca a9 00 95 02 30 ee c5 3b 1b a2 01 ec 2e |.......0..;.....|
+| 1f 16 d2 ee 56 bd b0 aa fc 5c f6 08 33 23 8e cf |....V....\..3#..|
+| 9d ba 9b c5 bf 5f 6a d6 11 c0 57 1d cd 2a 69 d1 |....._j...W..*i.|
+| 91 79 75 8d 4f ef 85 22 03 45 6a ed 1f 7f 21 f1 |.yu.O..".Ej...!.|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 66 1e ed 1d d6 ba ad 53 0c 48 9b 68 cf 59 71 bb |f......S.H.h.Yq.|
+| c1 cb 5a 39 00 00 00 00 00 00 00 00 00 00 00 0b |..Z9............|
+ssl_decrypt_record found padding 11 final len 372
+checking mac (len 352, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352
+association_find: TCP port 4464 found 0x33faac0
+dissect_ssl3_record decrypted len 352
+decrypted app data fragment[352]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+dissect_ssl3_record found association 0x33faac0
+
+dissect_ssl enter frame #340 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 4d 82 89 a1 01 5d b7 aa e9 8a f1 d0 1b cd 4a 50 |M....]........JP|
+| 23 48 99 e9 5a 22 1f 20 9d c3 71 2d 53 42 ac 5d |#H..Z". ..q-SB.]|
+Plaintext[32]:
+| 01 00 8d 89 fa 6b 27 57 56 73 1b f5 a1 34 8e a8 |.....k'WVs...4..|
+| e7 a1 48 5a 7c 31 00 00 00 00 00 00 00 00 00 09 |..HZ|1..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #342 (first time)
+ conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2a e8 2d 47 41 17 86 dd 58 53 95 72 73 d3 3b 44 |*.-GA...XS.rs.;D|
+| 5a 2e d0 73 30 2f 6f 2c 93 5f df bf 5b cb 86 3a |Z..s0/o,._..[..:|
+Plaintext[32]:
+| 01 00 31 17 7e 4b a5 69 a3 21 bf 08 37 ca 45 60 |..1.~K.i.!..7.E`|
+| 40 59 49 ef 74 73 00 00 00 00 00 00 00 00 00 09 |@YI.ts..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #347 (first time)
+ssl_session_init: initializing ptr 0x7f265a95f890 size 688
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 56308 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4465
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #349 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #351 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aa...
+looking for RSA pre-master0080270d0ced1717f69c19e90ca47cc62028d259c1550d4a...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| 52 13 68 e3 5b d3 b4 08 7a 1b 54 79 c6 43 1f 72 |R.h.[...z.Ty.C.r|
+| 60 5d f1 82 13 f3 ef 8a 48 92 94 d6 04 ae b7 96 |`]......H.......|
+| 25 57 f9 90 fb 8d f5 4d c2 58 4c ba ef 04 d1 5b |%W.....M.XL....[|
+| 28 91 a4 9b 6e 6d 0b 91 48 32 cb 4b 71 8f 12 7d |(...nm..H2.Kq..}|
+| 29 7d dc ee 8d 6a d1 ce 6e 9a 6c 24 13 f1 a5 0e |)}...j..n.l$....|
+| 81 4c 3d 31 6a 3d 03 b2 c0 a6 ee fb a9 21 7b b8 |.L=1j=.......!{.|
+| a8 fe 1e e0 12 0a b0 27 37 eb 26 c4 6d a8 b5 d5 |.......'7.&.m...|
+| d1 90 44 7e 76 5b 99 79 53 89 c9 2e c2 6a 49 d8 |..D~v[.yS....jI.|
+| d2 04 4a cd 69 1f e1 e8 |..J.i... |
+Client MAC key[20]:
+| 52 13 68 e3 5b d3 b4 08 7a 1b 54 79 c6 43 1f 72 |R.h.[...z.Ty.C.r|
+| 60 5d f1 82 |`].. |
+Server MAC key[20]:
+| 13 f3 ef 8a 48 92 94 d6 04 ae b7 96 25 57 f9 90 |....H.......%W..|
+| fb 8d f5 4d |...M |
+Client Write key[32]:
+| c2 58 4c ba ef 04 d1 5b 28 91 a4 9b 6e 6d 0b 91 |.XL....[(...nm..|
+| 48 32 cb 4b 71 8f 12 7d 29 7d dc ee 8d 6a d1 ce |H2.Kq..})}...j..|
+Server Write key[32]:
+| 6e 9a 6c 24 13 f1 a5 0e 81 4c 3d 31 6a 3d 03 b2 |n.l$.....L=1j=..|
+| c0 a6 ee fb a9 21 7b b8 a8 fe 1e e0 12 0a b0 27 |.....!{........'|
+Client Write IV[16]:
+| 37 eb 26 c4 6d a8 b5 d5 d1 90 44 7e 76 5b 99 79 |7.&.m.....D~v[.y|
+Server Write IV[16]:
+| 53 89 c9 2e c2 6a 49 d8 d2 04 4a cd 69 1f e1 e8 |S....jI...J.i...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| b3 78 f0 b7 00 db a8 70 89 a6 35 d5 13 13 2a 76 |.x.....p..5...*v|
+| 4b da 48 74 6c f7 7b dc 89 05 ca ca 57 72 a5 e9 |K.Htl.{.....Wr..|
+ssl_save_session stored master secret[48]:
+| 2e 24 d1 37 9d a1 c2 42 97 d5 dc e0 66 bb 80 71 |.$.7...B....f..q|
+| 59 66 d2 cf d9 33 8c 6e bb 48 60 4e e5 6f c6 65 |Yf...3.n.H`N.o.e|
+| 9d 43 34 f2 38 8f 24 a4 6c 88 54 d1 4d d1 48 50 |.C4.8.$.l.T.M.HP|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a8 1b 41 24 3c 22 27 51 53 08 41 d4 17 82 bb 40 |..A$<"'QS.A....@|
+| 71 a9 56 84 4a e5 f2 87 cf 81 ac a5 d8 f3 03 42 |q.V.J..........B|
+| 60 a3 30 ec 65 dd 9e e3 22 42 70 8a 38 f2 1c 72 |`.0.e..."Bp.8..r|
+| ba 6c 62 4a 28 9f 6b 49 69 53 cf be bf 76 2d 6a |.lbJ(.kIiS...v-j|
+Plaintext[64]:
+| 14 00 00 24 8a da da 93 75 54 7e 61 31 db c6 3b |...$....uT~a1..;|
+| a6 15 a7 e4 41 d6 e0 d0 d9 e5 02 66 14 20 9e ff |....A......f. ..|
+| 01 22 6e 28 c7 aa 84 25 c6 7d 04 d8 9c e7 15 82 |."n(...%.}......|
+| 65 2e f4 a2 87 08 4d 4b 4e f0 31 5e 00 00 00 03 |e.....MKN.1^....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #352 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 6c 3a 30 9d b8 15 cb cb 19 26 ec b1 1b 54 bc f2 |l:0......&...T..|
+| da f8 47 bb 15 14 6a 89 87 17 12 6e 58 ee 13 6c |..G...j....nX..l|
+| ed 0f 7d de c2 78 52 4b fb 9c ce 00 ec 6d 50 f4 |..}..xRK.....mP.|
+| 6d c4 e4 50 93 fb 7c 16 f6 ed da 89 73 07 d5 e1 |m..P..|.....s...|
+Plaintext[64]:
+| 14 00 00 24 43 f6 31 e2 66 d1 80 f6 29 2d e4 de |...$C.1.f...)-..|
+| a1 cc f0 43 c5 39 f8 a9 81 ad e1 22 38 f7 cf a2 |...C.9....."8...|
+| f2 94 3a 0a cb f3 2e 85 a1 6c 0f 80 21 b3 de c6 |..:......l..!...|
+| 1a 31 b8 ed 8a d9 02 45 9c 92 53 73 00 00 00 03 |.1.....E..Ss....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #353 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 50 9d b8 7a 5e f5 6f ce 20 82 68 b8 83 6c 5d ef |P..z^.o. .h..l].|
+| 35 1d 88 0f 60 16 40 75 9e ca 96 18 34 85 b9 d3 |5...`.@u....4...|
+Plaintext[32]:
+| ac 9a 3c 85 65 f1 16 ed 2c 14 af bf 9d 07 4c b0 |..<.e...,.....L.|
+| 72 ab 5f cc 00 00 00 00 00 00 00 00 00 00 00 0b |r._.............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 56308 found (nil)
+association_find: TCP port 4465 found 0x33fab50
+ record: offset = 37, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 6c 8c fb 6f 9d 7b 28 aa d8 15 d7 e0 05 15 49 09 |l..o.{(.......I.|
+| 4d 49 1b 97 0c 17 1e b3 72 03 e2 62 55 3b 3a a6 |MI......r..bU;:.|
+| 0f 7d f0 26 98 ee c2 cb e7 9b ce 03 4c 7f 40 ad |.}.&........L.@.|
+| 17 de 94 20 e6 41 f8 cf 59 01 c0 da 7c 8f cc 2f |... .A..Y...|../|
+| b7 58 ae bb 23 c8 ff 19 99 f1 9a c9 30 1b 44 b4 |.X..#.......0.D.|
+| ff e4 84 08 67 13 7b 9c d7 eb 46 99 d3 5c 4f 59 |....g.{...F..\OY|
+| b0 57 b9 78 9e dc f9 df cd 0e 8e a9 a0 4e e1 2b |.W.x.........N.+|
+Plaintext[112]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a 45 b0 2f |n.nl:4465....E./|
+| 05 54 98 f4 77 34 d0 04 cf db 5d 3d 6c e9 c0 e3 |.T..w4....]=l...|
+| ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................|
+ssl_decrypt_record found padding 14 final len 97
+checking mac (len 77, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77
+association_find: TCP port 56308 found (nil)
+association_find: TCP port 4465 found 0x33fab50
+dissect_ssl3_record decrypted len 77
+decrypted app data fragment[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a |n.nl:4465.... |
+dissect_ssl3_record found association 0x33fab50
+
+dissect_ssl enter frame #354 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 96 83 d2 6a a6 af ad 15 00 65 15 34 79 b0 2c 88 |...j.....e.4y.,.|
+| 6c 80 7a 93 30 22 f7 e0 42 c9 6a 09 5d 4d 5b 22 |l.z.0"..B.j.]M["|
+| dd e8 59 bd f1 48 65 41 e9 0f 49 e6 12 f6 da 9c |..Y..HeA..I.....|
+| b6 36 c8 db 95 48 42 be 9b 98 c3 ba a6 d8 93 b3 |.6...HB.........|
+| 30 8d 51 e1 bb 79 41 6f 82 d4 2b f0 94 90 71 b6 |0.Q..yAo..+...q.|
+| be 15 a8 51 17 83 08 12 99 39 57 e2 07 08 4d 4d |...Q.....9W...MM|
+| 37 f2 2c cf fe 40 be a8 36 04 e7 5a cc e2 0f a4 |7.,..@..6..Z....|
+| 29 2a 61 72 0e f4 72 00 41 68 48 26 59 c0 3f ef |)*ar..r.AhH&Y.?.|
+| 6e 26 62 9c 60 2f 7b 17 a5 51 70 29 7d 4b 2f d0 |n&b.`/{..Qp)}K/.|
+| e0 68 d9 8e e1 34 08 01 d0 30 8d 16 9f 33 10 5d |.h...4...0...3.]|
+| 17 f1 93 b5 bd df a5 eb 6f 06 19 b0 ba 2b ac bc |........o....+..|
+| e6 c2 23 ca 35 5c a1 99 b4 67 8b 86 57 d8 17 cf |..#.5\...g..W...|
+| f9 cd 77 0b 3a a4 bb 9f b6 11 f8 b0 74 29 02 8c |..w.:.......t)..|
+| 76 ab 29 c5 2a 8e ef 9f 55 aa f1 e6 54 1d 30 68 |v.).*...U...T.0h|
+| 5d da 85 3d 93 f5 a0 4b bd 15 19 7e e4 f0 be 4f |]..=...K...~...O|
+| 7d ed ec d4 c7 2a 16 2a a5 ec b1 28 df e0 60 37 |}....*.*...(..`7|
+| 43 3a 74 85 f6 1f f6 05 1a b4 d2 61 a7 2c e5 c5 |C:t........a.,..|
+| 8d a7 29 f8 51 30 5d f4 67 23 b5 53 73 f4 01 29 |..).Q0].g#.Ss..)|
+| 43 30 c6 63 5c ef 38 21 4a 93 85 9d 4d 04 46 5d |C0.c\.8!J...M.F]|
+| 08 99 95 99 0d 94 21 33 4c 9a c8 15 19 04 48 53 |......!3L.....HS|
+| fa a5 33 bf 5f 36 dd de 24 df a6 55 63 67 a9 cd |..3._6..$..Ucg..|
+| 50 98 52 0c 5a 6b a7 4c f6 44 22 cf 46 d9 be 2c |P.R.Zk.L.D".F..,|
+| 38 80 17 a6 b4 b7 38 b2 94 53 4d e6 31 23 db bb |8.....8..SM.1#..|
+| 20 e7 de c2 46 6d 10 f1 dd c3 68 72 49 4d 0a 32 | ...Fm....hrIM.2|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 5c 4b a9 dd 8d a4 e3 0e 11 33 a0 1e 92 e5 6b 21 |\K.......3....k!|
+| ac d0 bb 8e 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 372
+checking mac (len 352, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352
+association_find: TCP port 4465 found 0x33fab50
+dissect_ssl3_record decrypted len 352
+decrypted app data fragment[352]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+dissect_ssl3_record found association 0x33fab50
+
+dissect_ssl enter frame #355 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e5 a8 37 71 ec 7b d3 cb 90 4c f3 af 41 59 5b 9c |..7q.{...L..AY[.|
+| 74 b3 26 d0 35 8c 31 57 30 91 9a 25 80 0c b2 a1 |t.&.5.1W0..%....|
+Plaintext[32]:
+| 01 00 16 f4 b2 d4 a1 f5 3b 8b 50 de 99 38 15 b7 |........;.P..8..|
+| 3a 4f dc 11 60 da 00 00 00 00 00 00 00 00 00 09 |:O..`...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #357 (first time)
+ conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d5 0e 93 2d d5 82 99 a1 19 2b 5d 49 b0 36 c8 19 |...-.....+]I.6..|
+| e0 ab 77 6e ce 8a 9e bb 26 bf 17 69 56 4f 3b bf |..wn....&..iVO;.|
+Plaintext[32]:
+| 01 00 f1 55 a0 28 eb 5e 55 0e b9 75 47 62 33 87 |...U.(.^U..uGb3.|
+| 24 35 f5 61 50 44 00 00 00 00 00 00 00 00 00 09 |$5.aPD..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #362 (first time)
+ssl_session_init: initializing ptr 0x7f265a962080 size 688
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 46652 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4470
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #364 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 907
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907
+
+dissect_ssl enter frame #366 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 340
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 260, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e74764...
+looking for RSA pre-mastera3b81f035d1a021f9c64064c1aa318f73236099700f9e432...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 77 2a d9 e2 67 d9 ae 26 20 fd 04 20 a7 5d ba de |w*..g..& .. .]..|
+| 62 53 76 3a 49 e6 c2 8b dd 0a 71 96 d3 27 8e 75 |bSv:I.....q..'.u|
+| f8 6b 8f cb e5 50 51 4b fa 00 8e cc bc 12 8f f2 |.k...PQK........|
+| 5a 22 1d bc 4e b0 20 4c 37 ca a8 b2 f3 82 0b 01 |Z"..N. L7.......|
+| be e8 2f 8b 19 99 b6 dd 99 ed 8e e2 99 7e a3 f7 |../..........~..|
+| 45 10 18 1d 18 67 8e 3a 68 bf bf 72 8c 8a 35 12 |E....g.:h..r..5.|
+| 81 5d 93 81 0d 45 1f 27 |.]...E.' |
+Client MAC key[20]:
+| 77 2a d9 e2 67 d9 ae 26 20 fd 04 20 a7 5d ba de |w*..g..& .. .]..|
+| 62 53 76 3a |bSv: |
+Server MAC key[20]:
+| 49 e6 c2 8b dd 0a 71 96 d3 27 8e 75 f8 6b 8f cb |I.....q..'.u.k..|
+| e5 50 51 4b |.PQK |
+Client Write key[16]:
+| fa 00 8e cc bc 12 8f f2 5a 22 1d bc 4e b0 20 4c |........Z"..N. L|
+Server Write key[16]:
+| 37 ca a8 b2 f3 82 0b 01 be e8 2f 8b 19 99 b6 dd |7........./.....|
+Client Write IV[16]:
+| 99 ed 8e e2 99 7e a3 f7 45 10 18 1d 18 67 8e 3a |.....~..E....g.:|
+Server Write IV[16]:
+| 68 bf bf 72 8c 8a 35 12 81 5d 93 81 0d 45 1f 27 |h..r..5..]...E.'|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 8b c8 fa dd 2c 31 88 b1 86 d5 af 4a 5a 43 b8 bd |....,1.....JZC..|
+| 60 26 36 a5 1d 0e 82 21 ab c0 ae 0c 71 fa 1b 4d |`&6....!....q..M|
+ssl_save_session stored master secret[48]:
+| 81 0d 99 70 d5 5a bb 4d 34 d2 7a bc 38 a0 f2 d9 |...p.Z.M4.z.8...|
+| 4b b3 2b 4a 3b ca 51 2e 36 44 0d 2c 9d e9 4f 60 |K.+J;.Q.6D.,..O`|
+| a7 75 39 ad ca a7 79 81 c7 e4 5a 64 a4 4d 35 bf |.u9...y...Zd.M5.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 265, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 271, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 29 10 5c b3 89 20 b5 b7 e9 5a 33 a1 53 4a 66 6b |).\.. ...Z3.SJfk|
+| 8c 5b db f9 ca ca f1 53 e0 e9 35 ee 96 a2 77 b1 |.[.....S..5...w.|
+| 96 6f 93 bf 16 3c f3 fc 18 b7 8a a3 42 11 3f 15 |.o...<......B.?.|
+| 3e 1d 10 80 75 46 08 51 c1 dd 0a 18 33 a7 0f 2e |>...uF.Q....3...|
+Plaintext[64]:
+| 14 00 00 24 23 c3 03 9d 17 12 a0 b2 9f cc 90 a0 |...$#...........|
+| b2 1d 89 64 54 7e b4 4a 3f 34 e9 3d 7f fb 86 cd |...dT~.J?4.=....|
+| 40 80 1b 9b b7 68 26 68 f7 2e be 73 13 1b 49 2a |@....h&h...s..I*|
+| 78 5b d9 70 91 82 34 1c 6e ae 84 87 00 00 00 03 |x[.p..4.n.......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #367 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| bd a2 07 ba e6 25 27 38 0c 2b 0b e4 54 a6 23 72 |.....%'8.+..T.#r|
+| 1f b9 0b 60 22 ec 30 44 bf 01 fb f3 3e 2d 3d fb |...`".0D....>-=.|
+| 5a 0d 7d dc 45 6a d9 eb 0a 0f 9d 07 ff 7f ef dc |Z.}.Ej..........|
+| af 25 a9 e5 32 82 f0 26 cc 2b 2b 58 07 9c 68 58 |.%..2..&.++X..hX|
+Plaintext[64]:
+| 14 00 00 24 70 e8 83 47 03 d5 8f 4b d5 96 ce aa |...$p..G...K....|
+| 90 56 70 7d 50 ed 77 24 62 2f 08 47 61 ae 0e 8c |.Vp}P.w$b/.Ga...|
+| 59 be fb b8 d6 56 a6 24 8a 16 74 4f 33 8b 2d 1a |Y....V.$..tO3.-.|
+| 7f ff 16 77 9b 42 cf 01 1f f9 1c 0b 00 00 00 03 |...w.B..........|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #368 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d9 97 b1 ce cc 73 6e 4d 8e 2a 97 39 ab 55 ea c3 |.....snM.*.9.U..|
+| 3a 89 93 02 d6 6e 7b 92 b7 b0 63 fc 54 b5 46 45 |:....n{...c.T.FE|
+Plaintext[32]:
+| 3f 1b 73 6f 37 41 d4 3f 96 19 4f 3f 19 d7 80 bc |?.so7A.?..O?....|
+| 1f 0e 01 ab 00 00 00 00 00 00 00 00 00 00 00 0b |................|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 46652 found (nil)
+association_find: TCP port 4470 found 0x33fae20
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| ee 33 c6 8c 8f f4 b0 9a 18 a9 ca c2 a9 83 70 5a |.3............pZ|
+| 40 0a db 0b 80 08 f2 47 e4 48 15 54 15 c8 cb a7 |@......G.H.T....|
+| bd 71 5d 05 d7 99 6e f0 fa e8 ae 07 8f 4c a7 9e |.q]...n......L..|
+| 44 93 7e 66 db 2e ec 8a 2a a5 db c6 89 d5 72 fd |D.~f....*.....r.|
+| c8 ab dc 64 52 01 5d e7 d2 51 cb bd 95 6f 84 e6 |...dR.]..Q...o..|
+| 13 07 c7 c5 4b 3d c0 53 3a 7f 87 24 3d 41 39 4a |....K=.S:..$=A9J|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a be 64 |yn.nl:4470.....d|
+| 86 6e 8b dc 51 73 26 d0 f2 3f 3b 83 13 a6 5b 1e |.n..Qs&..?;...[.|
+| 12 f9 00 00 00 00 00 00 00 00 00 00 00 00 00 0d |................|
+ssl_decrypt_record found padding 13 final len 82
+checking mac (len 62, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 62, seq = 0, nxtseq = 62
+association_find: TCP port 46652 found (nil)
+association_find: TCP port 4470 found 0x33fae20
+dissect_ssl3_record decrypted len 62
+decrypted app data fragment[62]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a |yn.nl:4470.... |
+dissect_ssl3_record found association 0x33fae20
+
+dissect_ssl enter frame #369 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 31 7e 99 82 29 51 6b 8f 0f 68 ae 2f b2 91 da f6 |1~..)Qk..h./....|
+| 27 4e 8a 53 71 7c d5 fb d1 41 05 5e 59 b2 47 1b |'N.Sq|...A.^Y.G.|
+| 73 d9 4c bb 1a a7 19 4e d2 d9 e5 01 af 3e 80 3b |s.L....N.....>.;|
+| be 01 ea 49 2f 1b ff b0 39 aa 6b fc d8 9c d5 13 |...I/...9.k.....|
+| 99 2d 85 8c fe cd b6 30 1c a0 a5 f9 10 bd 80 97 |.-.....0........|
+| 48 f2 b1 81 44 6f 40 8b b7 3c a4 21 de 1b d6 44 |H...Do@..<.!...D|
+| 08 14 f8 b0 e2 9c 1a a9 e8 8b 23 6a 5d c3 ce a9 |..........#j]...|
+| 39 48 a3 5c 0b 30 18 2f 10 6f f8 fe c4 d8 10 17 |9H.\.0./.o......|
+| 20 ea b6 83 d9 f9 77 3e e6 b2 09 b8 d9 49 83 44 | .....w>.....I.D|
+| 32 b5 45 7d 63 5b 96 f8 4a b9 88 50 ee aa 56 59 |2.E}c[..J..P..VY|
+| 30 67 1e 0a 4b 2e 67 ac 29 62 eb d2 f0 21 88 c3 |0g..K.g.)b...!..|
+| d9 17 ff 31 ac 03 ff 4e 5c 10 01 70 a8 38 1e a0 |...1...N\..p.8..|
+| 5a 23 7f fb 06 0f e7 a0 27 d0 9c a4 2b 90 df 6b |Z#......'...+..k|
+| cb 96 d6 ff 83 1e 7c 83 6e dd a6 87 c9 2f 2d 3f |......|.n..../-?|
+| 3d d1 14 49 a2 30 8d 7b 68 ed 4f d0 32 0f 4a b5 |=..I.0.{h.O.2.J.|
+| e9 f2 db a4 86 31 2c 11 8b 9d 27 55 f7 56 f6 14 |.....1,...'U.V..|
+| a5 89 ef e4 ab b4 c4 eb 9b 93 51 75 d5 1e a8 60 |..........Qu...`|
+| da 73 4e 37 10 b6 f6 2a 6a 40 c3 ee 90 f2 8d 69 |.sN7...*j@.....i|
+| ca 0c f2 c9 2d b9 8e df 97 a7 01 f0 06 3c 2b fa |....-........<+.|
+| 57 c7 88 81 63 45 5c 00 f1 b9 5d 19 9d ff 8b 03 |W...cE\...].....|
+| 81 31 36 8c 4d 7b f5 56 75 51 e4 8e f7 3a b9 51 |.16.M{.VuQ...:.Q|
+| d8 9a 8e f1 a7 63 c4 9a 8a 6e b1 46 4f 12 b6 95 |.....c...n.FO...|
+| c3 87 42 49 58 40 7a a2 6f e4 bd 9a 0b 9e 0a 7f |..BIX@z.o.......|
+| 36 2d 08 b7 e9 c0 52 c2 ef d6 08 01 e8 33 61 79 |6-....R......3ay|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-|
+| 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ba b8 f2 43 |nl'</script>...C|
+| 5e fd dc 46 92 da d3 7e 3b 07 04 cb e9 4b 4b 62 |^..F...~;....KKb|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4470 found 0x33fae20
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-|
+| 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x33fae20
+
+dissect_ssl enter frame #370 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 33 3e 78 bf 46 ef 2a eb 23 79 d7 64 53 7d cb e2 |3>x.F.*.#y.dS}..|
+| 05 cc d6 e0 0d 4f 05 de f7 11 0c 0b 8d 80 b7 a1 |.....O..........|
+Plaintext[32]:
+| 01 00 29 97 23 f3 61 d6 63 76 2e 4d a2 73 fa 46 |..).#.a.cv.M.s.F|
+| b1 8a 26 b9 5a c0 00 00 00 00 00 00 00 00 00 09 |..&.Z...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #372 (first time)
+ conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e3 67 c9 d9 df f0 53 fc 8a 55 c6 a9 05 40 16 9a |.g....S..U...@..|
+| 67 27 8b 14 64 99 c8 a2 d0 67 e7 08 c5 b5 cf 35 |g'..d....g.....5|
+Plaintext[32]:
+| 01 00 8a 08 b6 ca 2a 91 5a b0 44 76 0f 62 10 86 |......*.Z.Dv.b..|
+| f5 d9 85 98 f2 be 00 00 00 00 00 00 00 00 00 09 |................|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #377 (first time)
+ssl_session_init: initializing ptr 0x7f265a9648d0 size 688
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 59945 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4471
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #379 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 1155
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1069
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826
+ record: offset = 826, reported_length_remaining = 329
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 315, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146
+ record: offset = 1146, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155
+
+dissect_ssl enter frame #381 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822...
+looking for RSA pre-master008058019e6ee7bbd131f56d378653bab5bae6b0f32976c0...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| a2 f3 41 b5 99 80 64 21 bc 41 19 e2 c8 cf 2c 0a |..A...d!.A....,.|
+| e6 5a 42 42 c4 72 d6 d3 a2 51 23 fd fb 95 82 8f |.ZBB.r...Q#.....|
+| 66 cc d5 88 c8 3b 52 88 4d 26 a8 5a c0 73 45 a0 |f....;R.M&.Z.sE.|
+| fd 5b 9b 48 ef f8 cb 6b b7 01 7d 7e 0b be 6f 7e |.[.H...k..}~..o~|
+| b4 60 2f 28 df 2c 5f 4b d3 56 75 82 0c 6d 24 a1 |.`/(.,_K.Vu..m$.|
+| e3 75 40 5d 33 76 a8 e1 a1 85 05 af 82 9f 54 e2 |.u@]3v........T.|
+| dd 33 e1 b6 92 c3 95 e4 |.3...... |
+Client MAC key[20]:
+| a2 f3 41 b5 99 80 64 21 bc 41 19 e2 c8 cf 2c 0a |..A...d!.A....,.|
+| e6 5a 42 42 |.ZBB |
+Server MAC key[20]:
+| c4 72 d6 d3 a2 51 23 fd fb 95 82 8f 66 cc d5 88 |.r...Q#.....f...|
+| c8 3b 52 88 |.;R. |
+Client Write key[16]:
+| 4d 26 a8 5a c0 73 45 a0 fd 5b 9b 48 ef f8 cb 6b |M&.Z.sE..[.H...k|
+Server Write key[16]:
+| b7 01 7d 7e 0b be 6f 7e b4 60 2f 28 df 2c 5f 4b |..}~..o~.`/(.,_K|
+Client Write IV[16]:
+| d3 56 75 82 0c 6d 24 a1 e3 75 40 5d 33 76 a8 e1 |.Vu..m$..u@]3v..|
+Server Write IV[16]:
+| a1 85 05 af 82 9f 54 e2 dd 33 e1 b6 92 c3 95 e4 |......T..3......|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| e8 42 b9 5d 1b a5 e4 ad 74 75 cf 8b 7d b2 42 5a |.B.]....tu..}.BZ|
+| 5a 99 1d 1e fe 2d f3 f1 fb 58 6a f1 dd 71 21 f1 |Z....-...Xj..q!.|
+ssl_save_session stored master secret[48]:
+| 37 93 4c dc b8 1b ac ff 4e 07 04 57 94 e0 97 51 |7.L.....N..W...Q|
+| 77 a0 ce 42 70 a1 c8 db fd 0d 38 02 91 82 55 5e |w..Bp.....8...U^|
+| bb 88 8a db de 71 8d a0 58 6c 3d bd 17 4e 0f 02 |.....q..Xl=..N..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 82 8a 47 18 e6 58 5f 0a 4b fc 8a f5 6a cb a8 40 |..G..X_.K...j..@|
+| fd 9a 65 c7 f1 29 77 5c 07 5c 87 36 bb 5c 92 da |..e..)w\.\.6.\..|
+| 39 c2 8b bc c6 d2 41 cb cc e4 82 c0 9a 0b 1c 30 |9.....A........0|
+| e9 b4 78 96 f2 96 a7 70 d9 b5 b9 31 6c 7e 29 b4 |..x....p...1l~).|
+Plaintext[64]:
+| 14 00 00 24 30 10 e8 77 bb af d5 53 b7 7d f0 60 |...$0..w...S.}.`|
+| 3e 7b 26 85 c4 60 35 4a 2b 71 32 85 cb f3 9d 6f |>{&..`5J+q2....o|
+| 11 4c c6 7a 46 99 7f f5 5c 3a f8 b0 8d cc d1 f5 |.L.zF...\:......|
+| 14 81 ca aa 70 8c 0b f0 ca 32 0d 24 00 00 00 03 |....p....2.$....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #382 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a4 1f 1b d5 55 1c c1 e5 e1 cc 14 c0 db 38 a9 ed |....U........8..|
+| df 21 86 31 8e 97 00 f8 a8 e8 16 a1 1f cb 02 eb |.!.1............|
+| d0 7c 83 fb 25 08 dd 6c 6d d9 b4 e1 56 b0 22 eb |.|..%..lm...V.".|
+| 03 a4 32 51 33 85 57 29 13 ff 31 97 28 92 f6 b8 |..2Q3.W)..1.(...|
+Plaintext[64]:
+| 14 00 00 24 47 6c b9 e8 28 61 6a e5 f6 c7 1e d9 |...$Gl..(aj.....|
+| 9b 8b ea e1 8a 31 a3 e9 26 44 59 49 25 55 ea 01 |.....1..&DYI%U..|
+| 31 74 cc 8a 66 92 1d 01 a5 2d e7 8a ef da 9d b9 |1t..f....-......|
+| 0a 50 51 ae ff be 54 fa 7e 88 1b 7b 00 00 00 03 |.PQ...T.~..{....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #383 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| c7 22 0d e4 0f c5 40 f2 29 42 c4 1b ea 3f 48 ff |."....@.)B...?H.|
+| b2 81 ac f7 4c 9b 11 74 c9 57 da 74 a3 6b f8 45 |....L..t.W.t.k.E|
+Plaintext[32]:
+| 58 e3 53 65 a8 41 2b fc 9d 63 fa 88 98 77 9d 70 |X.Se.A+..c...w.p|
+| 26 85 21 6d 00 00 00 00 00 00 00 00 00 00 00 0b |&.!m............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 59945 found (nil)
+association_find: TCP port 4471 found 0x33faeb0
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 75 82 74 86 51 26 1f 7d 77 31 bd 79 ce 30 b3 10 |u.t.Q&.}w1.y.0..|
+| d7 77 90 a7 b3 61 d1 35 d8 d0 be 86 8d 25 46 67 |.w...a.5.....%Fg|
+| ae f8 6a 85 49 47 2e 06 cb c0 e3 27 97 18 d7 d2 |..j.IG.....'....|
+| f5 99 09 f9 98 b5 38 4a 59 f8 fe 36 a0 89 97 5c |......8JY..6...\|
+| 0c 68 17 48 97 1f 69 61 20 3e 18 0c d8 7b 80 ea |.h.H..ia >...{..|
+| de 96 d3 19 b2 82 ed 0e dd d5 83 6f 69 c1 91 09 |...........oi...|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 31 0d 0a 0d 0a 5a fa 5b 84 06 57 a8 cb 48 c6 |71....Z.[..W..H.|
+| 55 dc a5 2e d6 3d ea fc d2 79 00 00 00 00 00 05 |U....=...y......|
+ssl_decrypt_record found padding 5 final len 90
+checking mac (len 70, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 70, seq = 0, nxtseq = 70
+association_find: TCP port 59945 found (nil)
+association_find: TCP port 4471 found 0x33faeb0
+dissect_ssl3_record decrypted len 70
+decrypted app data fragment[70]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 31 0d 0a 0d 0a |71.... |
+dissect_ssl3_record found association 0x33faeb0
+
+dissect_ssl enter frame #384 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 83 50 b1 03 83 d8 e1 48 af 02 60 1a de 91 a6 a7 |.P.....H..`.....|
+| 55 39 0f b7 8e fe 2b 67 f4 c5 4e 16 a2 e0 4c 57 |U9....+g..N...LW|
+| 48 69 e4 fb 46 92 b6 96 21 ea 23 4d dd b5 63 f5 |Hi..F...!.#M..c.|
+| 0e be a1 d6 ce 71 1f de 29 49 6e 29 29 7a 29 74 |.....q..)In))z)t|
+| 9b ec 55 16 78 0a da b3 b1 9f 78 af 8a df bb e8 |..U.x.....x.....|
+| 5e 8d c9 f4 01 e8 16 7a 81 fc 86 f3 5f 41 68 28 |^......z...._Ah(|
+| f8 d9 b7 41 58 ba d1 4b 6c af 97 40 4b 9c 4b 88 |...AX..Kl..@K.K.|
+| 6f d1 23 de 69 4d a1 87 a0 cb 75 75 bb 5d b8 67 |o.#.iM....uu.].g|
+| 54 95 bb c9 c7 c8 0d 8d dc 80 e9 09 b0 f1 53 fd |T.............S.|
+| 88 43 a8 ba 14 12 ff e8 40 1a f2 f8 a2 e8 bf 56 |.C......@......V|
+| 6c b7 6b e5 2f 62 b5 41 b8 dc 9e 13 08 ba 34 12 |l.k./b.A......4.|
+| a8 28 80 3d 69 9a 30 19 79 1d 99 69 3f e0 51 49 |.(.=i.0.y..i?.QI|
+| 28 17 dc 3d e3 82 e2 a1 34 56 c9 1f fe e7 81 25 |(..=....4V.....%|
+| 52 27 93 5d b4 37 8d ff 56 99 34 a7 3c e4 fd b9 |R'.].7..V.4.<...|
+| cc 78 85 00 92 be 5d 73 00 2b 8e b9 02 a0 14 fb |.x....]s.+......|
+| a9 6f 20 66 ef a7 93 0a e6 0e 8f 6a 32 81 4f ca |.o f.......j2.O.|
+| 41 f6 a9 24 a7 88 75 fc 3e 7a d9 c3 2b 2f fd b6 |A..$..u.>z..+/..|
+| cf e2 77 b2 29 f4 da 20 6e 80 b7 46 86 08 b2 73 |..w.).. n..F...s|
+| 96 2e ac b6 dd ad dc 2f d2 28 28 c5 66 8a 35 bd |......./.((.f.5.|
+| 25 a9 06 c3 3c 00 a4 cb 09 2c fc b9 14 c1 bc 66 |%...<....,.....f|
+| 32 2e 6b 09 01 ce 98 d5 04 6e 98 30 4b 65 c9 01 |2.k......n.0Ke..|
+| 93 17 ae 52 4a 3d 9f a0 9f c7 6b c3 77 6e bf f0 |...RJ=....k.wn..|
+| ed f1 84 bd 4c ec 6f a8 25 07 ea bf 80 97 bb 93 |....L.o.%.......|
+| 80 24 09 4e 8f 5a 7c ff 97 d7 7a a9 1a e2 4a 44 |.$.N.Z|...z...JD|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D|
+| 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 89 5d 1a 2d |nl'</script>.].-|
+| 41 61 03 b1 11 5a 6a f0 b5 04 de f0 d5 86 12 49 |Aa...Zj........I|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4471 found 0x33faeb0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D|
+| 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x33faeb0
+
+dissect_ssl enter frame #385 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 1f 0c 4e 12 9b 11 71 07 91 2c f9 99 32 03 3e 55 |..N...q..,..2.>U|
+| 82 bd e0 00 24 70 2f aa 8e 1d 97 ff 5f 2c 82 75 |....$p/....._,.u|
+Plaintext[32]:
+| 01 00 18 e3 99 72 42 13 47 cd 38 bd a0 68 33 c3 |.....rB.G.8..h3.|
+| 26 2b 3e 2b d1 bb 00 00 00 00 00 00 00 00 00 09 |&+>+............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #387 (first time)
+ conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 9d 0d 92 e6 dd 0b 77 b5 a0 b0 07 8b 73 16 30 26 |......w.....s.0&|
+| 67 cd 53 11 2e 75 8e ef 79 a6 1d 02 2f bd b3 d3 |g.S..u..y.../...|
+Plaintext[32]:
+| 01 00 61 b0 b8 66 66 15 4e c4 36 d4 96 55 2c 4e |..a..ff.N.6..U,N|
+| 2b a3 d6 53 c5 05 00 00 00 00 00 00 00 00 00 09 |+..S............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #392 (first time)
+ssl_session_init: initializing ptr 0x7f265a9670b0 size 688
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 34124 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4472
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #394 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 1437
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1351
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 539
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 525, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428
+ record: offset = 1428, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437
+
+dissect_ssl enter frame #396 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6...
+looking for RSA pre-master0080ab63b848965c0e404e86cd067d30a0b332dfb34de8dd...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 1e 94 f5 56 f6 64 04 e7 c9 2e 9e c0 11 b4 b0 69 |...V.d.........i|
+| 5e ad c0 1c af 26 9d a6 02 e1 fc 2d 5e a0 ee 4b |^....&.....-^..K|
+| 13 e8 fa 40 6b 4c 20 2f 22 43 04 97 0c d1 70 cc |...@kL /"C....p.|
+| 47 8a 0b 76 0f 8d 5d 78 bc 00 1f bc 6c 52 52 0a |G..v..]x....lRR.|
+| 9b 9e f6 8c 0d 47 2c d0 94 d9 de a7 0c 19 b6 45 |.....G,........E|
+| 64 83 df 04 bc 6e 30 66 94 db ce 7a 4f 10 c4 08 |d....n0f...zO...|
+| d6 1d 5a a6 63 48 d6 27 |..Z.cH.' |
+Client MAC key[20]:
+| 1e 94 f5 56 f6 64 04 e7 c9 2e 9e c0 11 b4 b0 69 |...V.d.........i|
+| 5e ad c0 1c |^... |
+Server MAC key[20]:
+| af 26 9d a6 02 e1 fc 2d 5e a0 ee 4b 13 e8 fa 40 |.&.....-^..K...@|
+| 6b 4c 20 2f |kL / |
+Client Write key[16]:
+| 22 43 04 97 0c d1 70 cc 47 8a 0b 76 0f 8d 5d 78 |"C....p.G..v..]x|
+Server Write key[16]:
+| bc 00 1f bc 6c 52 52 0a 9b 9e f6 8c 0d 47 2c d0 |....lRR......G,.|
+Client Write IV[16]:
+| 94 d9 de a7 0c 19 b6 45 64 83 df 04 bc 6e 30 66 |.......Ed....n0f|
+Server Write IV[16]:
+| 94 db ce 7a 4f 10 c4 08 d6 1d 5a a6 63 48 d6 27 |...zO.....Z.cH.'|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 35 0c b4 73 8f bb fc a0 d5 0c c1 f8 76 47 5a 45 |5..s........vGZE|
+| 60 f3 0f ca f3 7d b2 db c9 81 bf 73 1e 93 47 7d |`....}.....s..G}|
+ssl_save_session stored master secret[48]:
+| 66 f4 0e fa 23 0e 9a 7d 5c 6f c2 53 b4 78 3d d1 |f...#..}\o.S.x=.|
+| a2 4e e1 6c 7e e9 b5 59 0b f4 3d bf b5 56 b0 13 |.N.l~..Y..=..V..|
+| be e0 c9 0e 56 d4 59 a4 01 98 bf 81 d3 a6 0f f3 |....V.Y.........|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 51 17 1e 8b 96 be f9 63 f9 5b b6 2c d0 d6 b2 dd |Q......c.[.,....|
+| b2 df 42 25 53 d4 a8 21 4f 47 66 d9 c5 ba 19 ac |..B%S..!OGf.....|
+| c9 63 bd d1 a9 0b 7d c1 42 83 1e 96 17 0a 74 fd |.c....}.B.....t.|
+| 70 69 5d 9d e1 08 0b c2 74 2f 95 c8 f1 9a e7 63 |pi].....t/.....c|
+Plaintext[64]:
+| 14 00 00 24 50 f5 0a 9f e5 5e 55 e8 b8 c7 46 e3 |...$P....^U...F.|
+| be 76 eb 7d 35 ec 32 12 0a a9 a1 3e 52 69 0f 79 |.v.}5.2....>Ri.y|
+| 25 8a 54 18 68 bb 2d 12 fd 5f 8c f1 10 2f 90 b8 |%.T.h.-.._.../..|
+| 41 9e 8b f9 52 87 25 95 23 fb 56 cf 00 00 00 03 |A...R.%.#.V.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #397 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 96 52 bc 52 f5 df 7f 51 ce fb 9f 62 6e e7 56 20 |.R.R...Q...bn.V |
+| 8b 37 12 c9 3a c0 76 69 e8 0f ad 66 50 37 da 4c |.7..:.vi...fP7.L|
+| 31 24 a7 2b 96 a8 fc d9 1f 12 cc 69 a1 57 c2 85 |1$.+.......i.W..|
+| 1a 7f 4e c3 df 00 83 ad c2 c2 ad da 8a c7 d5 41 |..N............A|
+Plaintext[64]:
+| 14 00 00 24 39 8e 9d a6 28 0c 6f fe 05 da a1 a1 |...$9...(.o.....|
+| 50 6d b8 4c 97 c9 2d 8b fa 75 3e 6c 58 74 39 9f |Pm.L..-..u>lXt9.|
+| c8 45 42 15 4d a4 4a 1b a0 10 b1 94 ee f6 ee a4 |.EB.M.J.........|
+| ef 14 21 21 75 f0 0a 89 76 14 30 fa 00 00 00 03 |..!!u...v.0.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #398 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 0d 12 11 ba 94 e8 2a 05 1f a4 3f 8a 98 e0 95 46 |......*...?....F|
+| 58 c6 9a c9 13 96 75 d5 63 36 91 34 95 92 f5 f2 |X.....u.c6.4....|
+Plaintext[32]:
+| 65 87 68 fc 87 75 77 2f c4 59 b1 38 e1 dd 96 c8 |e.h..uw/.Y.8....|
+| bb 63 56 ae 00 00 00 00 00 00 00 00 00 00 00 0b |.cV.............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 34124 found (nil)
+association_find: TCP port 4472 found 0x33faf40
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 2f 3c 44 e6 d5 4d 7e f8 67 7a 9a 02 34 d3 f9 92 |/<D..M~.gz..4...|
+| d4 82 c1 80 20 47 e0 f0 fb df 67 9b 10 71 38 e6 |.... G....g..q8.|
+| 23 85 67 c7 ef 75 d3 da 81 a8 3f ce 2b f1 d3 74 |#.g..u....?.+..t|
+| 78 fe 64 e2 7a 39 58 c0 cc 66 ff e7 6e f6 56 29 |x.d.z9X..f..n.V)|
+| 27 33 5e 46 2a f0 68 a3 5d 00 ed 21 5d 8f b7 1d |'3^F*.h.]..!]...|
+| c1 30 7a 0f b2 e6 aa f8 13 20 00 8f a1 44 f8 83 |.0z...... ...D..|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 73 65 |Host: dhe-rsa-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 32 0d 0a 0d 0a ba 3a c9 91 80 35 91 cb d8 ab |72.....:...5....|
+| 7c b5 c1 2d 52 a9 cb 45 97 93 00 00 00 00 00 05 ||..-R..E........|
+ssl_decrypt_record found padding 5 final len 90
+checking mac (len 70, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 70, seq = 0, nxtseq = 70
+association_find: TCP port 34124 found (nil)
+association_find: TCP port 4472 found 0x33faf40
+dissect_ssl3_record decrypted len 70
+decrypted app data fragment[70]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 73 65 |Host: dhe-rsa-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 32 0d 0a 0d 0a |72.... |
+dissect_ssl3_record found association 0x33faf40
+
+dissect_ssl enter frame #399 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| f0 4b e0 3a 2b a8 11 8a 83 8a 21 48 b1 24 4e 4b |.K.:+.....!H.$NK|
+| dc d1 f9 8d 90 4d 1d 75 71 07 d1 f6 54 6a 37 7c |.....M.uq...Tj7||
+| ff 20 9b 31 99 24 41 ae ac 9c aa 94 39 b6 73 9b |. .1.$A.....9.s.|
+| 5d 6c 74 54 1c bb 76 82 73 68 9e 39 37 e7 f9 41 |]ltT..v.sh.97..A|
+| cd 9a ac 37 ab 1a ca dc ba 0e 16 5b 57 76 d8 f5 |...7.......[Wv..|
+| c7 bd dc f9 8b 98 10 29 9e e8 ea e9 9a 0d ff d4 |.......)........|
+| 2b 64 8c ac 8f d3 01 95 d9 e6 8a e7 cc 50 e9 9e |+d...........P..|
+| 77 a7 07 94 1a d4 35 a5 f0 66 05 8c 4d 8f 42 12 |w.....5..f..M.B.|
+| d2 d6 ff 25 1f 9a 48 ff 97 8c a3 8c 51 e1 02 52 |...%..H.....Q..R|
+| 43 c6 eb ea 66 e7 a0 7f 15 a0 30 9b d1 e4 83 12 |C...f.....0.....|
+| 04 b0 ea 99 cc 0c 52 2e 6b 4f 97 65 98 cc 11 90 |......R.kO.e....|
+| eb b0 4c 32 57 c9 8c f9 eb e9 80 a1 11 f0 f1 2f |..L2W........../|
+| bc f2 b5 1c 05 9f ca 88 a6 bf be 30 dc 24 3f 02 |...........0.$?.|
+| 90 72 59 48 45 da fc c5 42 39 4c 53 77 37 1e 32 |.rYHE...B9LSw7.2|
+| 4e ce c3 9d 56 24 b9 f9 f8 80 bd c5 94 73 e6 ee |N...V$.......s..|
+| 95 ae 6f d2 9d 03 64 32 d5 94 d5 b7 c6 22 a5 dc |..o...d2....."..|
+| 10 5b 75 58 c4 5c 87 cc 33 d4 34 83 e8 17 fa 73 |.[uX.\..3.4....s|
+| 52 d1 aa d7 a9 06 c8 8b ef c0 e6 aa 02 5c ba 2d |R............\.-|
+| 3c 8c 6b b9 96 13 60 82 78 4d d7 18 18 54 ef 93 |<.k...`.xM...T..|
+| 9a b1 87 48 11 2c b8 d3 f0 2f 6e 1e 8c 7c 21 2f |...H.,.../n..|!/|
+| 0e a7 a7 5c c3 e1 8c ec 66 b0 b0 af 4e b6 bd 09 |...\....f...N...|
+| 2a 31 7e 05 b1 2b 71 95 db 77 32 9f 8f bc 74 45 |*1~..+q..w2...tE|
+| 8b 49 5f fc 4e 5e 97 03 b3 63 b1 d2 ec f6 55 61 |.I_.N^...c....Ua|
+| 06 e3 e4 85 c2 aa 1c 9c a4 73 62 cb ff 3b 6d b4 |.........sb..;m.|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R|
+| 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 37 e2 f6 0b |nl'</script>7...|
+| f3 f8 64 c6 ee 7b 68 2e c0 51 49 75 a9 1d 76 04 |..d..{h..QIu..v.|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4472 found 0x33faf40
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R|
+| 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x33faf40
+
+dissect_ssl enter frame #400 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| fe 86 f8 b9 54 f3 3c d9 68 13 9a f3 66 e4 3d 6c |....T.<.h...f.=l|
+| d4 1c cb 9f 7f e9 b3 66 e9 f5 03 eb 93 35 c8 65 |.......f.....5.e|
+Plaintext[32]:
+| 01 00 68 64 f0 76 79 c3 62 1b 85 a8 93 08 22 2a |..hd.vy.b....."*|
+| ec 13 65 62 ff ee 00 00 00 00 00 00 00 00 00 09 |..eb............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #402 (first time)
+ conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ee 9a 0b f3 31 dc 31 06 e2 45 9f f4 0e e2 45 7d |....1.1..E....E}|
+| 01 bc 24 63 49 69 6d 82 07 f3 ee e0 8c 4a 86 ea |..$cIim......J..|
+Plaintext[32]:
+| 01 00 c0 10 f4 bb 0b 1d ea 13 33 aa 75 f3 4a 90 |..........3.u.J.|
+| ee 61 39 a7 a1 9a 00 00 00 00 00 00 00 00 00 09 |.a9.............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #407 (first time)
+ssl_session_init: initializing ptr 0x7f265a969850 size 688
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 33655 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4479
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #409 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 580
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC002 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580
+
+dissect_ssl enter frame #411 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 178
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f8101...
+looking for RSA pre-master6104b27e809142b6c4c4bbc1426d7dcb4c7a7ca32d86026d...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| f8 60 cd db 08 3a a1 af 86 cf c2 6a 6d 0e 8c 4c |.`...:.....jm..L|
+| b8 e5 f3 2a c0 c8 cc 89 53 6c 04 03 e9 3b 68 dd |...*....Sl...;h.|
+| 51 d0 d0 d0 9d 09 6c 78 7c fb 3d 9b f8 a2 6c 73 |Q.....lx|.=...ls|
+| 38 40 c2 29 f8 5f 82 16 15 cb e2 a7 16 7d 56 19 |8@.)._.......}V.|
+| da 03 8c 84 14 46 88 37 |.....F.7 |
+Client MAC key[20]:
+| f8 60 cd db 08 3a a1 af 86 cf c2 6a 6d 0e 8c 4c |.`...:.....jm..L|
+| b8 e5 f3 2a |...* |
+Server MAC key[20]:
+| c0 c8 cc 89 53 6c 04 03 e9 3b 68 dd 51 d0 d0 d0 |....Sl...;h.Q...|
+| 9d 09 6c 78 |..lx |
+Client Write key[16]:
+| 7c fb 3d 9b f8 a2 6c 73 38 40 c2 29 f8 5f 82 16 ||.=...ls8@.)._..|
+Server Write key[16]:
+| 15 cb e2 a7 16 7d 56 19 da 03 8c 84 14 46 88 37 |.....}V......F.7|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 30 62 76 03 00 00 00 00 |0bv..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| fc 0f 3d 50 65 d2 25 d1 a2 f7 1d dd cf c7 c8 b8 |..=Pe.%.........|
+| 31 41 94 6e 7e 7b 74 23 b2 42 e5 53 1e a3 06 c2 |1A.n~{t#.B.S....|
+ssl_save_session stored master secret[48]:
+| 8d f0 3f 66 86 32 bb 32 07 28 e1 74 31 5a 97 ee |..?f.2.2.(.t1Z..|
+| c8 e9 16 71 45 fc e1 04 60 57 f2 2d cc ba 9e 01 |...qE...`W.-....|
+| 87 10 cf dd 4e f4 e6 9c aa 61 a4 f8 f3 0b bb 75 |....N....a.....u|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| db 80 58 29 85 59 9d 60 79 b7 68 33 97 4e a5 ad |..X).Y.`y.h3.N..|
+| 8e d3 5e 2b 8b 05 74 6d ea 25 4f 24 e7 fe b0 23 |..^+..tm.%O$...#|
+| 55 82 22 b9 c0 bf 4f db 83 55 0e af bc 94 9a 1c |U."...O..U......|
+| 56 91 bd 30 5a 22 7f 00 6c a4 36 75 |V..0Z"..l.6u |
+Plaintext[60]:
+| 14 00 00 24 c3 c0 ff 4d 1d 20 37 93 5f c4 da 01 |...$...M. 7._...|
+| 43 cf 6a 19 cd fe d6 9e ca f6 2d e7 9c 23 1c 7c |C.j.......-..#.||
+| 97 58 b7 2d b5 41 e3 a5 9b 47 82 0a d5 84 a3 6e |.X.-.A...G.....n|
+| a0 bb 6c 32 9a 36 41 d4 1d 62 f0 9a |..l2.6A..b.. |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #412 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| 6a ae d5 9b 79 7d 58 c9 f6 77 a1 47 8a 43 50 b3 |j...y}X..w.G.CP.|
+| 5a fb e7 e1 2e f1 a3 ca 3d 9a ed ca 53 a2 a9 a1 |Z.......=...S...|
+| c4 83 a1 34 1c f0 4d 96 66 84 53 76 42 62 e7 2b |...4..M.f.SvBb.+|
+| 9c b5 77 21 b7 7b 31 d6 49 2c 1b 1b |..w!.{1.I,.. |
+Plaintext[60]:
+| 14 00 00 24 a6 96 3c d6 9b db 9d f9 dd 08 14 1c |...$..<.........|
+| 16 54 eb b5 3c 40 09 4c a1 cc 4e eb 62 02 9d 08 |.T..<@.L..N.b...|
+| 60 0a fa 57 1d 45 b6 10 83 53 e8 eb 25 53 b7 ad |`..W.E...S..%S..|
+| c5 0e 9b f4 41 0e f2 c8 1a 4c 1f 5c |....A....L.\ |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #413 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 97
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 92, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 92
+Ciphertext[92]:
+| 7c bf 0f 21 93 cc 46 5b 89 30 8a 5f 71 22 da 63 ||..!..F[.0._q".c|
+| 99 9d 6f c3 28 1b a2 0a c6 e8 0d d4 e7 15 60 b8 |..o.(.........`.|
+| c1 21 67 49 b9 4e 72 05 b0 b6 7b 92 a2 11 7f 3d |.!gI.Nr...{....=|
+| 75 43 e3 f7 3f 7e 34 fd 7c 83 f0 c1 e7 27 1d f2 |uC..?~4.|....'..|
+| d9 0d ab 67 08 6f dc b8 60 2f 63 11 8d 69 5b c9 |...g.o..`/c..i[.|
+| 5d 10 38 b2 a7 8c b8 a9 49 e6 72 df |].8.....I.r. |
+Plaintext[92]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a c8 ed 99 88 9d f7 65 86 |4479..........e.|
+| d0 7f fb 2f a1 ec eb 05 01 1f a0 de |.../........ |
+checking mac (len 72, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 33655 found (nil)
+association_find: TCP port 4479 found 0x345d8a0
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a |4479.... |
+dissect_ssl3_record found association 0x345d8a0
+
+dissect_ssl enter frame #414 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 375
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 370, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 370
+Ciphertext[370]:
+| 50 c0 ad 81 7b 70 09 c9 24 33 f7 1a ee fa 1f 73 |P...{p..$3.....s|
+| fc 24 54 2b 3b b0 4a 1e b1 86 95 8f a0 c5 2d e0 |.$T+;.J.......-.|
+| de 67 de e4 d8 f9 07 54 0b 2a 0a 52 e8 a9 8a d7 |.g.....T.*.R....|
+| 47 a1 81 65 48 b0 1d 37 72 46 35 c0 8f ee be b4 |G..eH..7rF5.....|
+| a1 c3 d2 68 3d 27 bc 3b ad 77 18 60 41 66 19 bd |...h='.;.w.`Af..|
+| 86 8e 6b a8 8a 07 df 7b e2 6f 45 0f 0d 75 75 07 |..k....{.oE..uu.|
+| d6 3a eb 40 37 df 3d 63 f7 b1 75 76 e1 00 fd ed |.:.@7.=c..uv....|
+| c3 9d fb b8 3c 11 34 47 35 4f 0b 60 0d c8 ac 01 |....<.4G5O.`....|
+| 27 64 61 ec 58 e9 ee bb a2 7a de 0e 0b 2a 11 af |'da.X....z...*..|
+| 56 89 0b 4c ff d9 a0 31 b3 d9 0f bc c1 09 0c c5 |V..L...1........|
+| 67 30 8c 92 5e 3a 15 d6 57 06 84 49 80 9c e2 3b |g0..^:..W..I...;|
+| 18 20 7c 6b a1 e1 e5 b8 df 3a 41 c8 d0 bc ec ff |. |k.....:A.....|
+| 0a 97 3e 75 6b 46 9e e4 ee bf 0e 1c 5d 58 01 56 |..>ukF......]X.V|
+| 58 09 ce cb 96 03 38 cf 5b 6f 48 d4 38 2d 96 86 |X.....8.[oH.8-..|
+| 6e 4a a6 fc 52 f9 1f c2 13 ba ca 0e d2 41 08 91 |nJ..R........A..|
+| 9e ce 7b e3 c4 47 4f f4 8f 1e 5a 26 0c 0b d7 eb |..{..GO...Z&....|
+| 45 d6 45 b5 fc b1 5a 06 23 22 a6 0c eb 2e fe 76 |E.E...Z.#".....v|
+| ac 9b f9 74 02 f0 d2 a4 fd a6 1a f4 a9 4d 54 0b |...t.........MT.|
+| 07 c4 86 14 46 b3 7b 85 84 4f 33 4b 64 92 be be |....F.{..O3Kd...|
+| 21 53 3a 47 14 72 6a 68 12 76 ca 50 b6 8b 78 63 |!S:G.rjh.v.P..xc|
+| 2d fa eb 26 18 c3 a0 b4 99 5b 3b 88 4e cf f5 2f |-..&.....[;.N../|
+| d1 55 a0 69 00 e8 f5 0f c0 d5 64 15 2d f3 4d c0 |.U.i......d.-.M.|
+| 83 5b db 48 1d 42 d7 55 82 3a 97 d4 94 3c 2c 9d |.[.H.B.U.:...<,.|
+| 9a af |.. |
+Plaintext[370]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 8b 5f |n.nl'</script>._|
+| ed 4b 1e a8 be 14 56 c3 bc 2c 27 1a 06 30 9c 5f |.K....V..,'..0._|
+| 4f e4 |O. |
+checking mac (len 350, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4479 found 0x345d8a0
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x345d8a0
+
+dissect_ssl enter frame #415 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 95 6c b2 62 87 72 f1 db 4b 8b c9 e9 f3 79 2e c6 |.l.b.r..K....y..|
+| 01 25 98 e4 7d dd |.%..}. |
+Plaintext[22]:
+| 01 00 36 2a 2b 07 60 cf e2 77 62 85 d0 9f c3 02 |..6*+.`..wb.....|
+| f1 c2 45 ac 0d d5 |..E... |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #417 (first time)
+ conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 0e 1c 56 1b 02 3a 13 f2 1b ab 00 cb 8d 66 0d e7 |..V..:.......f..|
+| 66 a9 1f 8d 64 dc |f...d. |
+Plaintext[22]:
+| 01 00 c7 c6 ef bc 01 bf 0f 98 0d d2 66 1d 83 91 |............f...|
+| c5 1d d3 a3 72 aa |....r. |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #422 (first time)
+ssl_session_init: initializing ptr 0x7f265a96bfc0 size 688
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 45042 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4480
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #424 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 580
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580
+
+dissect_ssl enter frame #426 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a310905...
+looking for RSA pre-master6104a21bd003208777a9d262e2c77f1c5b7868535c99346f...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| b5 82 38 42 8a 7f 22 27 10 59 3b f3 97 e1 75 70 |..8B.."'.Y;...up|
+| b7 08 49 fe e3 88 8e e8 1f 0c 47 9f bc 82 11 ed |..I.......G.....|
+| c6 c2 52 f9 23 17 3a a1 5e 0b 8b f0 3c e8 45 0d |..R.#.:.^...<.E.|
+| ab 6a 04 8e 55 8c ba 07 3e d1 46 f3 5b 5a 8a 65 |.j..U...>.F.[Z.e|
+| 9c ea 1e ec 5b 21 49 32 6f 60 c6 15 f4 9a 1a 11 |....[!I2o`......|
+| ef 6e e0 57 45 f8 80 d1 81 fd 16 b3 70 c4 3d d7 |.n.WE.......p.=.|
+| b0 bf b8 5d 3f 26 9a c6 |...]?&.. |
+Client MAC key[20]:
+| b5 82 38 42 8a 7f 22 27 10 59 3b f3 97 e1 75 70 |..8B.."'.Y;...up|
+| b7 08 49 fe |..I. |
+Server MAC key[20]:
+| e3 88 8e e8 1f 0c 47 9f bc 82 11 ed c6 c2 52 f9 |......G.......R.|
+| 23 17 3a a1 |#.:. |
+Client Write key[24]:
+| 5e 0b 8b f0 3c e8 45 0d ab 6a 04 8e 55 8c ba 07 |^...<.E..j..U...|
+| 3e d1 46 f3 5b 5a 8a 65 |>.F.[Z.e |
+Server Write key[24]:
+| 9c ea 1e ec 5b 21 49 32 6f 60 c6 15 f4 9a 1a 11 |....[!I2o`......|
+| ef 6e e0 57 45 f8 80 d1 |.n.WE... |
+Client Write IV[8]:
+| 81 fd 16 b3 70 c4 3d d7 |....p.=. |
+Server Write IV[8]:
+| b0 bf b8 5d 3f 26 9a c6 |...]?&.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| f7 b9 9c 55 b1 32 ff 56 19 56 85 0b 2f 95 57 29 |...U.2.V.V../.W)|
+| b5 c1 9d aa 6b 7b 60 21 81 d2 2d a9 d2 d2 74 9e |....k{`!..-...t.|
+ssl_save_session stored master secret[48]:
+| 91 9b b0 82 07 92 15 a5 74 ff 74 2b c9 76 ae 56 |........t.t+.v.V|
+| 1e 8a 13 85 c6 bc 38 d8 80 f6 51 9d 7e 0d f4 ad |......8...Q.~...|
+| 35 6c 57 9f db 81 b2 4a b5 77 01 d3 9f 0a 78 c3 |5lW....J.w....x.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 43 3a a8 78 40 c2 26 28 d5 79 a5 15 f8 25 f0 60 |C:.x@.&(.y...%.`|
+| d9 2d 04 0e a4 8c ee 76 24 ea 08 70 11 12 4b 04 |.-.....v$..p..K.|
+| 3d a9 1b 74 23 76 b1 3c d4 fb 41 30 69 39 ff 01 |=..t#v.<..A0i9..|
+| e0 90 24 6e 42 70 91 1e 87 2e c8 4b ec d5 df d6 |..$nBp.....K....|
+Plaintext[64]:
+| 14 00 00 24 d5 44 83 94 e9 9e dc 07 01 9b 0f c9 |...$.D..........|
+| 10 d2 f5 6c 10 97 7e b9 67 f2 ea 36 6d 95 03 db |...l..~.g..6m...|
+| b9 5e f2 cc d5 b6 21 6e aa de cd d4 4f b8 7c fe |.^....!n....O.|.|
+| 09 54 a2 0e b2 81 9e 7d 08 9a b0 22 00 00 00 03 |.T.....}..."....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #427 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| d0 1a ad 02 b2 32 f7 d0 3b 36 45 19 ac d0 ea 1a |.....2..;6E.....|
+| d3 80 ce 44 92 74 4c 31 35 c1 07 55 a6 7a 44 f0 |...D.tL15..U.zD.|
+| db 6b 38 e2 b3 25 98 d2 65 2a e6 93 df 83 53 08 |.k8..%..e*....S.|
+| b7 98 a3 04 75 2f 4a f2 1b 62 6e d3 21 5b 80 f7 |....u/J..bn.![..|
+Plaintext[64]:
+| 14 00 00 24 c5 1f 46 9f 63 fd a7 81 4c ea 69 42 |...$..F.c...L.iB|
+| fd b5 e6 55 36 7d e6 55 b9 45 a9 0d 62 1a df 9f |...U6}.U.E..b...|
+| b7 e2 22 63 ac 45 69 53 5d fd c3 60 ca 43 dc d7 |.."c.EiS]..`.C..|
+| 3e e8 02 d1 0a 1d 5a 5a 6f d4 fd 75 00 00 00 03 |>.....ZZo..u....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #428 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 6a 89 0e a2 05 76 50 f7 f5 c1 5f be 5a 7f 65 94 |j....vP..._.Z.e.|
+| 94 f8 72 b7 99 d6 63 d5 |..r...c. |
+Plaintext[24]:
+| e6 12 1c 44 a4 c8 62 42 22 a5 fc c2 06 cf 04 2c |...D..bB"......,|
+| cb eb 2e 85 00 00 00 03 |........ |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 45042 found (nil)
+association_find: TCP port 4480 found 0x345d930
+ record: offset = 29, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 0c bc e0 ef 49 3f f3 41 8d c3 36 71 17 70 6a db |....I?.A..6q.pj.|
+| 27 8d 10 6f b1 6a 49 23 f4 ba 3c 3e 2b d8 94 e6 |'..o.jI#..<>+...|
+| 5f 7e 51 f0 97 4a ad b6 7a 0d 6f f9 d7 00 23 6f |_~Q..J..z.o...#o|
+| a8 df ce 11 e6 2c b1 12 42 ab d6 e8 42 32 06 06 |.....,..B...B2..|
+| f8 2e ee ea 71 89 4a 79 2f 72 45 8a 70 a6 94 77 |....q.Jy/rE.p..w|
+| 3a 51 d9 69 0a 72 40 a7 75 30 07 10 83 9d a0 86 |:Q.i.r@.u0......|
+| d8 79 31 2c c8 19 ee 44 |.y1,...D |
+Plaintext[104]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f |-des-cbc3-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 38 30 0d 0a 0d 0a 2e 53 71 |n.nl:4480.....Sq|
+| 63 49 ef 2c 43 f9 b5 0c 23 7b b2 f0 1e 44 5f b5 |cI.,C...#{...D_.|
+| 59 00 00 00 00 00 00 06 |Y....... |
+ssl_decrypt_record found padding 6 final len 97
+checking mac (len 77, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77
+association_find: TCP port 45042 found (nil)
+association_find: TCP port 4480 found 0x345d930
+dissect_ssl3_record decrypted len 77
+decrypted app data fragment[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f |-des-cbc3-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 38 30 0d 0a 0d 0a |n.nl:4480.... |
+dissect_ssl3_record found association 0x345d930
+
+dissect_ssl enter frame #429 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| a9 57 98 35 02 36 9b 78 a1 22 6e ed ed 6d 54 61 |.W.5.6.x."n..mTa|
+| e4 4a 1e dd e5 09 f5 de 39 6e 56 d9 d1 50 49 a2 |.J......9nV..PI.|
+| d9 15 5c 73 07 ed e2 00 46 de bc fd 55 c7 d5 5d |..\s....F...U..]|
+| 6a d0 5a 9b 2e 65 cf 04 af 1b 1d 5d c3 bf 9c 69 |j.Z..e.....]...i|
+| 34 bd 85 9e 32 c3 bc 05 4c 33 44 1f 68 20 65 aa |4...2...L3D.h e.|
+| 2b 6d 25 22 a7 98 3d 06 0e 80 df 21 e1 b8 fd 49 |+m%"..=....!...I|
+| 9f a6 a7 89 07 db 98 18 97 08 7d ff 30 e1 50 f1 |..........}.0.P.|
+| 21 ed 67 73 91 79 be c4 08 fa 78 e0 62 46 38 d0 |!.gs.y....x.bF8.|
+| a5 7a 28 9d 2e b3 6a 06 58 96 32 f7 7b b2 e8 d2 |.z(...j.X.2.{...|
+| 92 07 91 df f2 9c 91 6f 59 45 ba 60 cd 04 12 c8 |.......oYE.`....|
+| 09 fe bc 11 9c 19 eb 5d 7b a8 85 c4 8a df a4 32 |.......]{......2|
+| ae c1 48 55 6c 43 25 b4 ac 5a 89 63 66 a8 3e 4a |..HUlC%..Z.cf.>J|
+| 74 4e 00 75 9a 90 b1 fc 81 2a 35 e0 c1 9c 8e b0 |tN.u.....*5.....|
+| 7c 5b 7e b4 5b 07 29 d7 b4 b5 f2 cc d1 a3 eb 3d ||[~.[.)........=|
+| 88 4f 42 5a f7 10 65 cf 97 6d 48 c3 d5 2b a7 80 |.OBZ..e..mH..+..|
+| 0e 79 d8 8e b5 88 57 2d 42 7f de 6f 43 79 f0 92 |.y....W-B..oCy..|
+| a8 82 13 9c 01 86 77 6b 9f 44 a5 9b f2 71 fa f5 |......wk.D...q..|
+| 88 59 f7 3f c6 17 2e 04 be ac 41 81 25 26 09 e2 |.Y.?......A.%&..|
+| cb d1 86 cc eb 2e cc d1 2d 35 ea f4 7f 2b 10 f3 |........-5...+..|
+| 17 ce 4c 29 6a 94 3f ba d4 9f db 16 b9 0d 81 3c |..L)j.?........<|
+| 21 83 c6 da f3 21 5c 42 18 6a d5 06 0c 45 ff 84 |!....!\B.j...E..|
+| c5 0b 33 1b 3c 3d 2f a1 4c 47 c9 87 6a 2a b7 9e |..3.<=/.LG..j*..|
+| 8b 9d 66 ed 9a 4f 8f a3 e7 4e eb 7f 4a ff a9 c0 |..f..O...N..J...|
+| 17 e6 6d 37 9e 6d 01 5b |..m7.m.[ |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 33 20 2d 20 45 43 44 48 2d |xC0,0x03 - ECDH-|
+| 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 |ECDSA-DES-CBC3-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |HA SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 3a 0f |n.nl'</script>:.|
+| 59 76 dd 7b e4 6b 54 c3 6a a7 48 4a cf b4 a3 e5 |Yv.{.kT.j.HJ....|
+| d9 0b 00 00 00 00 00 05 |........ |
+ssl_decrypt_record found padding 5 final len 370
+checking mac (len 350, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4480 found 0x345d930
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 33 20 2d 20 45 43 44 48 2d |xC0,0x03 - ECDH-|
+| 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 |ECDSA-DES-CBC3-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |HA SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x345d930
+
+dissect_ssl enter frame #430 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 4e f4 41 da 90 f9 b3 5b c7 ce 91 d5 0a 30 ca ab |N.A....[.....0..|
+| cc 00 75 71 36 e4 e2 43 |..uq6..C |
+Plaintext[24]:
+| 01 00 c8 7d 19 36 1a 13 54 c3 8d 1f db 0d 20 f4 |...}.6..T..... .|
+| eb 64 5c f5 ea f2 00 01 |.d\..... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #432 (first time)
+ conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 23 91 27 d7 e8 7c 31 6d f9 f7 da 42 5d f0 5c 4e |#.'..|1m...B].\N|
+| 29 d3 bb ad 2e a6 fc 18 |)....... |
+Plaintext[24]:
+| 01 00 70 c1 63 00 48 5f c9 87 f3 46 5b 3d ea 49 |..p.c.H_...F[=.I|
+| 02 6b 60 df 15 21 00 01 |.k`..!.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #437 (first time)
+ssl_session_init: initializing ptr 0x7f265a96e740 size 688
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 34763 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4481
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #439 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 580
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580
+
+dissect_ssl enter frame #441 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441...
+looking for RSA pre-master6104dcbebaeb774575f0636e72b821ad452adbc4042bd399...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 69 92 f0 9e df 91 75 c6 86 e7 29 9e 3b 89 a7 97 |i.....u...).;...|
+| cc b3 be 87 96 b8 db a2 d9 a4 7b e9 13 23 64 0b |..........{..#d.|
+| 67 53 bb 73 1a a3 9d 1f 89 75 15 57 57 20 ab 49 |gS.s.....u.WW .I|
+| a6 fe 60 bb f4 26 6b 90 c0 ea 14 6c 8b 64 e3 2a |..`..&k....l.d.*|
+| bc a5 33 79 f6 de aa 0f 3b bd 00 b3 10 4a 52 db |..3y....;....JR.|
+| 99 05 ab 1a 3d 6b d8 50 8f ac b5 57 44 f8 af 06 |....=k.P...WD...|
+| ea 48 27 e5 6f 10 2e 02 |.H'.o... |
+Client MAC key[20]:
+| 69 92 f0 9e df 91 75 c6 86 e7 29 9e 3b 89 a7 97 |i.....u...).;...|
+| cc b3 be 87 |.... |
+Server MAC key[20]:
+| 96 b8 db a2 d9 a4 7b e9 13 23 64 0b 67 53 bb 73 |......{..#d.gS.s|
+| 1a a3 9d 1f |.... |
+Client Write key[16]:
+| 89 75 15 57 57 20 ab 49 a6 fe 60 bb f4 26 6b 90 |.u.WW .I..`..&k.|
+Server Write key[16]:
+| c0 ea 14 6c 8b 64 e3 2a bc a5 33 79 f6 de aa 0f |...l.d.*..3y....|
+Client Write IV[16]:
+| 3b bd 00 b3 10 4a 52 db 99 05 ab 1a 3d 6b d8 50 |;....JR.....=k.P|
+Server Write IV[16]:
+| 8f ac b5 57 44 f8 af 06 ea 48 27 e5 6f 10 2e 02 |...WD....H'.o...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 2d 8b f1 9c 1c 52 f9 8a ed 5e 17 c0 7a 73 6e 85 |-....R...^..zsn.|
+| 35 8b 56 0b 39 d3 ed 58 b4 df a7 ce 63 8a a0 5e |5.V.9..X....c..^|
+ssl_save_session stored master secret[48]:
+| e8 7d 8c 6d 99 a1 d7 f4 d9 7e 83 e0 34 ea 06 b0 |.}.m.....~..4...|
+| 8f 88 6d 8b a7 1f f7 b8 96 74 98 10 06 aa 37 7b |..m......t....7{|
+| 74 ce 88 53 82 64 b2 66 0f 89 54 ed b4 52 a2 98 |t..S.d.f..T..R..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 14 8a 3e 07 56 39 e1 91 fe 0c 8c 0e eb 30 32 67 |..>.V9.......02g|
+| 9f e5 91 b9 e9 52 6a e9 66 51 f8 da 5d 8f 54 d8 |.....Rj.fQ..].T.|
+| 6b 8e 91 88 94 34 2c 3a b3 92 74 74 1b b3 82 1c |k....4,:..tt....|
+| 64 e6 3f a1 c8 f7 4c 8f 36 18 6c 4c 72 6d 9c de |d.?...L.6.lLrm..|
+Plaintext[64]:
+| 14 00 00 24 11 1d 34 ef 97 42 7b 77 5f 8f 03 a2 |...$..4..B{w_...|
+| d0 8b c5 2d a6 cf 21 74 cf 35 42 0e 80 60 7a f9 |...-..!t.5B..`z.|
+| e4 50 e4 75 0a 37 ec 6c da e4 4a ad 83 a0 d9 1e |.P.u.7.l..J.....|
+| 6a 26 8f bd 3b e4 32 dc 9f b1 58 49 00 00 00 03 |j&..;.2...XI....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #442 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 86 05 27 be bf be 05 18 55 72 cf 19 23 f3 00 46 |..'.....Ur..#..F|
+| 48 e3 ca 47 17 39 9d 12 04 88 12 11 aa 8b a9 82 |H..G.9..........|
+| 7f 66 74 98 e8 b3 df b2 94 6b 9e 8d f2 ed a0 1e |.ft......k......|
+| 89 ba a7 8a fc 2a 34 29 86 a7 f0 5b ef 88 0b a2 |.....*4)...[....|
+Plaintext[64]:
+| 14 00 00 24 52 51 98 25 3a 57 ca 13 b9 d0 ce d2 |...$RQ.%:W......|
+| d0 78 72 9e 64 aa 8d d0 24 8f 52 ae 05 f2 e3 ba |.xr.d...$.R.....|
+| 3a 5c aa 79 9e 01 ae a9 7c e2 5f 5c f7 7b cf 23 |:\.y....|._\.{.#|
+| ac a0 c6 09 22 46 71 3c d1 a3 84 67 00 00 00 03 |...."Fq<...g....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #443 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 38 5c 67 14 ae 01 2f e9 5e fa fc 96 32 9b 85 a6 |8\g.../.^...2...|
+| ad c5 64 04 94 a1 94 5b 84 97 fc 1f 11 ab c1 6d |..d....[.......m|
+Plaintext[32]:
+| 42 6a 00 bf 9d b2 ff 1a d0 63 f5 49 10 02 9b bd |Bj.......c.I....|
+| 58 ac 6e 49 00 00 00 00 00 00 00 00 00 00 00 0b |X.nI............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 34763 found (nil)
+association_find: TCP port 4481 found 0x345d9c0
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| db 4f 30 0c ec a8 51 73 4a aa 89 e1 4e 46 d6 74 |.O0...QsJ...NF.t|
+| fc f7 c9 30 d7 19 d8 f9 e1 e6 85 f9 c7 a5 1f 03 |...0............|
+| 8f 84 a3 25 96 24 09 f5 44 6a ef 43 67 78 7c 49 |...%.$..Dj.Cgx|I|
+| 6a e2 a3 ca 5b e3 8c c9 e1 27 6c 6f ad 80 79 c8 |j...[....'lo..y.|
+| 3f b8 12 a8 3a e5 16 29 42 4c df 2e d3 4d 37 d6 |?...:..)BL...M7.|
+| b6 68 6a e0 86 a0 f8 f7 e9 f2 57 c6 c4 e6 59 2b |.hj.......W...Y+|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 31 0d 0a 0d 0a 8f 37 4a de 8c |nl:4481.....7J..|
+| db bd 9c 36 da 0c 68 6b 70 9c b0 a0 a1 83 e8 00 |...6..hkp.......|
+ssl_decrypt_record found padding 0 final len 95
+checking mac (len 75, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 75, seq = 0, nxtseq = 75
+association_find: TCP port 34763 found (nil)
+association_find: TCP port 4481 found 0x345d9c0
+dissect_ssl3_record decrypted len 75
+decrypted app data fragment[75]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 31 0d 0a 0d 0a |nl:4481.... |
+dissect_ssl3_record found association 0x345d9c0
+
+dissect_ssl enter frame #444 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| a2 4b 75 a3 d0 a1 34 5b 4f 62 f1 ba 5c 71 3a b2 |.Ku...4[Ob..\q:.|
+| b4 71 16 69 66 03 8c 84 b0 44 20 c4 38 f9 26 e5 |.q.if....D .8.&.|
+| af c0 8a a9 64 d6 cc ec 75 18 cf 32 34 79 40 49 |....d...u..24y@I|
+| 3d da 90 d4 f9 b3 be fc 39 c2 10 f3 28 48 b5 d2 |=.......9...(H..|
+| 6e ca 8f 08 ee 17 e0 6d 32 bc 9a 6f d2 e3 e2 3e |n......m2..o...>|
+| eb bb b6 63 ab 3f 57 52 9e bd a5 a5 af c5 1f e3 |...c.?WR........|
+| e2 54 84 3f 66 cd f8 2e 1e 6d 5c c0 d4 20 68 a0 |.T.?f....m\.. h.|
+| f2 64 2a 92 0a 97 35 b1 a6 5a 5d 53 d2 c5 97 db |.d*...5..Z]S....|
+| e6 57 94 9d 13 34 fc ee 29 dd 88 4e bb 56 c5 6d |.W...4..)..N.V.m|
+| 5c 08 4c f8 a5 61 b9 4b 89 07 16 73 d8 d3 8e b6 |\.L..a.K...s....|
+| 47 f5 5f d7 83 d2 91 3d 63 f8 2e 68 d9 dd 0e 9c |G._....=c..h....|
+| 8b f8 9e f3 dd 1f 52 f6 ec 5a 16 c0 dc 31 75 f3 |......R..Z...1u.|
+| 04 86 30 77 08 ef 36 25 e3 28 94 15 54 48 4a 19 |..0w..6%.(..THJ.|
+| 68 02 12 db f5 27 f2 42 53 75 8f d1 4a 94 7c 5d |h....'.BSu..J.|]|
+| 46 6f cc 55 2d 54 cf ca df 7b 35 b3 9d c8 23 ab |Fo.U-T...{5...#.|
+| 8e 5c 68 6a 47 e1 d3 ad 11 90 ef 9c 79 f3 6e 42 |.\hjG.......y.nB|
+| f5 be 76 5d 04 ae 7a d8 04 90 54 ff 84 ac 58 b0 |..v]..z...T...X.|
+| 5d eb b8 48 52 cb 8a 2f f1 7b 31 c5 12 68 50 34 |]..HR../.{1..hP4|
+| dc 17 c5 56 77 d6 6c 9b d1 60 87 c4 c0 03 73 e7 |...Vw.l..`....s.|
+| 42 86 92 f0 fc 28 91 9e 35 a1 83 ea 24 e6 78 9a |B....(..5...$.x.|
+| de 22 2d e3 9d bb c4 40 9f c4 f8 e8 02 36 98 02 |."-....@.....6..|
+| 9e 10 fc 66 10 df 4a b4 a9 56 53 24 bd 5b db 25 |...f..J..VS$.[.%|
+| 52 b1 d9 58 82 7a be ea 9a 64 be 51 c9 52 93 a5 |R..X.z...d.Q.R..|
+| 61 8d d5 1d 20 70 28 24 84 fc 0f d5 9a 37 b2 28 |a... p($.....7.(|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 31 83 |n.nl'</script>1.|
+| 4e 83 26 de 79 21 70 43 e2 73 c3 de d5 3d 4c 4f |N.&.y!pC.s...=LO|
+| 44 df 00 00 00 00 00 00 00 00 00 00 00 00 00 0d |D...............|
+ssl_decrypt_record found padding 13 final len 370
+checking mac (len 350, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4481 found 0x345d9c0
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x345d9c0
+
+dissect_ssl enter frame #445 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 3d da d0 95 ba c3 02 e3 83 40 f1 a4 d0 e2 dd da |=........@......|
+| 3a 61 d8 28 10 f7 80 ba 89 7d 26 a0 6d 19 6b bf |:a.(.....}&.m.k.|
+Plaintext[32]:
+| 01 00 95 dd d4 0d 31 bf c6 ea f1 a9 8c 42 fd 29 |......1......B.)|
+| 53 52 b7 96 fe fd 00 00 00 00 00 00 00 00 00 09 |SR..............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #447 (first time)
+ conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| fb 05 a2 81 5a cb 4e 42 1e 4a 07 2d 44 95 da 5b |....Z.NB.J.-D..[|
+| 21 51 e1 38 a1 91 9c 9b 2f 35 c1 91 d2 59 8b 50 |!Q.8..../5...Y.P|
+Plaintext[32]:
+| 01 00 33 69 60 8c d3 fc 4a db 2c 83 0f 99 52 06 |..3i`...J.,...R.|
+| a8 b5 3c 50 25 67 00 00 00 00 00 00 00 00 00 09 |..<P%g..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #452 (first time)
+ssl_session_init: initializing ptr 0x7f265a970f00 size 688
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 60347 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4482
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #454 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 580
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580
+
+dissect_ssl enter frame #456 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e...
+looking for RSA pre-master6104da42fca8fb2b9867a2cc88604edbc52a3599d036eb77...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| d7 e7 9c 52 01 79 08 36 6b 93 96 b2 5f 14 c2 93 |...R.y.6k..._...|
+| 21 67 3a 51 a4 ed 45 0b 75 d5 b3 08 c7 bc 40 c3 |!g:Q..E.u.....@.|
+| 41 7f ec c8 a9 f4 23 6e c1 09 eb bb b6 34 03 74 |A.....#n.....4.t|
+| ef 15 5d 8a a3 eb 0f c7 52 17 8e 4e de ca 08 93 |..].....R..N....|
+| b5 c2 03 3a b8 f7 f4 c3 6d ba 65 fb 97 e0 35 54 |...:....m.e...5T|
+| ad df 38 78 8c c0 95 5d d4 23 1b ab ea 16 19 5b |..8x...].#.....[|
+| 6a 3c 4b 02 4e fb 6d 6d e1 fb ef e2 77 75 6d 96 |j<K.N.mm....wum.|
+| 3d 59 57 0f 90 d0 89 b5 db e5 b1 ed 89 4e f5 21 |=YW..........N.!|
+| df 70 52 e1 ed 7b 43 76 |.pR..{Cv |
+Client MAC key[20]:
+| d7 e7 9c 52 01 79 08 36 6b 93 96 b2 5f 14 c2 93 |...R.y.6k..._...|
+| 21 67 3a 51 |!g:Q |
+Server MAC key[20]:
+| a4 ed 45 0b 75 d5 b3 08 c7 bc 40 c3 41 7f ec c8 |..E.u.....@.A...|
+| a9 f4 23 6e |..#n |
+Client Write key[32]:
+| c1 09 eb bb b6 34 03 74 ef 15 5d 8a a3 eb 0f c7 |.....4.t..].....|
+| 52 17 8e 4e de ca 08 93 b5 c2 03 3a b8 f7 f4 c3 |R..N.......:....|
+Server Write key[32]:
+| 6d ba 65 fb 97 e0 35 54 ad df 38 78 8c c0 95 5d |m.e...5T..8x...]|
+| d4 23 1b ab ea 16 19 5b 6a 3c 4b 02 4e fb 6d 6d |.#.....[j<K.N.mm|
+Client Write IV[16]:
+| e1 fb ef e2 77 75 6d 96 3d 59 57 0f 90 d0 89 b5 |....wum.=YW.....|
+Server Write IV[16]:
+| db e5 b1 ed 89 4e f5 21 df 70 52 e1 ed 7b 43 76 |.....N.!.pR..{Cv|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 6c f6 63 83 8a b2 5a db 5e 84 12 5d de a2 ba 47 |l.c...Z.^..]...G|
+| fb 1e 44 bd 49 b9 b7 de 55 76 2f 81 5f 03 40 aa |..D.I...Uv/._.@.|
+ssl_save_session stored master secret[48]:
+| 6d 94 88 ff f6 90 f6 bf 52 15 b9 80 5e 9c fb f1 |m.......R...^...|
+| 45 46 38 07 cd b7 6d f9 4a e2 1a 2f 3c 0c d5 66 |EF8...m.J../<..f|
+| ad 78 f0 a0 14 11 66 87 b1 6c b2 fc e5 ec 30 0a |.x....f..l....0.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 10 c9 d0 bc 3f e6 10 ae 19 66 f2 06 09 de 8f cc |....?....f......|
+| 18 52 cc 97 c8 e0 09 32 8b ae 97 02 72 c6 d8 f8 |.R.....2....r...|
+| af 53 db 10 42 41 d3 b5 26 5b ed cd 1f a5 ca f9 |.S..BA..&[......|
+| 4d bf ec 57 f9 f5 70 26 ba 34 a9 9e 0a 98 a9 14 |M..W..p&.4......|
+Plaintext[64]:
+| 14 00 00 24 a5 f6 d2 22 4b 6f 74 5e 74 7a 32 98 |...$..."Kot^tz2.|
+| 38 90 75 b4 5f 55 33 4d 53 0b 81 51 d7 f6 b8 46 |8.u._U3MS..Q...F|
+| 1f e0 32 85 31 90 d6 a6 0a 7f b7 12 38 6b e8 01 |..2.1.......8k..|
+| 1b a3 72 2a cd 14 92 57 e7 d8 31 ce 00 00 00 03 |..r*...W..1.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #457 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 24 c5 43 3e 72 dd 18 35 4e 56 4d a8 d4 21 9b 33 |$.C>r..5NVM..!.3|
+| c2 0c 1d 6a 7b b1 76 7b 55 5d 7a d0 a5 32 2b 1a |...j{.v{U]z..2+.|
+| c9 b9 00 b4 03 30 b0 2b d2 75 ca 24 a5 59 af e2 |.....0.+.u.$.Y..|
+| f0 a8 01 81 8e fc 42 61 e6 38 ed 24 10 dc fd 21 |......Ba.8.$...!|
+Plaintext[64]:
+| 14 00 00 24 08 8b 3d f7 71 02 45 44 ce 3f d0 d9 |...$..=.q.ED.?..|
+| 23 8f d6 59 05 59 22 01 f5 ef cc 35 3f f8 9e e4 |#..Y.Y"....5?...|
+| af f0 64 11 34 72 bd a1 aa 23 bf 95 51 96 42 21 |..d.4r...#..Q.B!|
+| f4 22 7b 80 b9 b7 17 05 da 4e 12 7e 00 00 00 03 |."{......N.~....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #458 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 48 b6 32 ad 6e 93 7b e9 c6 10 fe af 1b 7f 94 83 |H.2.n.{.........|
+| 67 ea f8 0a 54 fe 95 37 f5 15 a8 f4 77 33 2f 6b |g...T..7....w3/k|
+Plaintext[32]:
+| 94 c3 c0 45 fd 71 41 8f 06 b8 23 0b 48 53 fc 50 |...E.qA...#.HS.P|
+| d1 60 7b e7 00 00 00 00 00 00 00 00 00 00 00 0b |.`{.............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 60347 found (nil)
+association_find: TCP port 4482 found 0x345da50
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| f5 82 d3 b7 71 42 74 27 d0 d2 cf 58 9f 48 58 73 |....qBt'...X.HXs|
+| e2 68 c8 f5 ab 99 f7 a0 d5 de 7b 8b 1b dd ac f6 |.h........{.....|
+| 68 65 3c c9 9b 8b f4 05 10 a3 26 e8 83 21 6c 5e |he<.......&..!l^|
+| b8 f0 26 23 fb 72 c4 c3 9f f8 ec e3 c3 f7 47 d6 |..&#.r........G.|
+| b8 d5 a3 61 25 aa 83 6e cd 57 9a 69 f7 b2 cc 5b |...a%..n.W.i...[|
+| 41 c6 b9 94 a6 f2 4c 0f 3b 62 7a 2c e2 d4 35 8e |A.....L.;bz,..5.|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 32 0d 0a 0d 0a 95 48 47 58 41 |nl:4482.....HGXA|
+| f6 b7 29 eb 31 e0 d6 18 97 5f 65 81 b3 f8 a1 00 |..).1...._e.....|
+ssl_decrypt_record found padding 0 final len 95
+checking mac (len 75, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 75, seq = 0, nxtseq = 75
+association_find: TCP port 60347 found (nil)
+association_find: TCP port 4482 found 0x345da50
+dissect_ssl3_record decrypted len 75
+decrypted app data fragment[75]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 32 0d 0a 0d 0a |nl:4482.... |
+dissect_ssl3_record found association 0x345da50
+
+dissect_ssl enter frame #459 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 0c 46 b2 8c 64 d4 e4 6d a4 17 f8 37 f9 43 9a de |.F..d..m...7.C..|
+| d3 de f6 7c cb cf d8 ab 81 ca f3 4e cc 14 c1 94 |...|.......N....|
+| 59 20 fe 27 a1 0d d4 b0 64 53 f1 2a 1c 7f be a6 |Y .'....dS.*....|
+| 65 e7 80 c0 33 3b de 22 e6 64 b1 df d2 9f e3 9a |e...3;.".d......|
+| cb 28 12 da 48 b5 b6 7e 3e 9d 89 93 30 eb 15 04 |.(..H..~>...0...|
+| d9 41 63 a4 62 ee ca 3f 8c 6b 04 47 48 5c e9 58 |.Ac.b..?.k.GH\.X|
+| aa b8 95 ad 73 31 fc 99 7a 9e af b7 d1 3e ff 36 |....s1..z....>.6|
+| 76 85 0d 3e f4 14 07 f3 72 3a ef 9c 53 66 f7 dd |v..>....r:..Sf..|
+| 69 be 73 a9 65 b5 bd e3 4b 87 5a 72 92 f1 49 8e |i.s.e...K.Zr..I.|
+| 87 fe 62 71 ed 18 9d a7 23 94 14 d2 72 c9 b9 e2 |..bq....#...r...|
+| 95 c2 a3 98 06 72 e5 26 ff af 29 7c 4d f2 f7 78 |.....r.&..)|M..x|
+| 6c fe 3d 7f 1c 85 a3 21 32 e6 7a 95 39 a0 10 75 |l.=....!2.z.9..u|
+| 25 0d 00 3e 40 86 9f 54 57 75 d8 a9 ba 69 75 36 |%..>@..TWu...iu6|
+| 96 11 52 b9 cb 12 1b e7 07 6a 9a 4a 02 4c 65 85 |..R......j.J.Le.|
+| 05 59 8d 74 1d b2 bb 77 c6 5c aa 5b cc f7 bd 74 |.Y.t...w.\.[...t|
+| ab bf bb 2e 0a 6c dc d2 6d f8 6b d4 6c 65 de 46 |.....l..m.k.le.F|
+| 7b 33 0c 09 11 56 47 65 24 16 11 9d 30 f7 27 23 |{3...VGe$...0.'#|
+| 85 45 d2 a1 5e e1 68 dc d2 2f 94 91 a1 88 f6 a3 |.E..^.h../......|
+| 62 e4 14 c7 89 d9 7c a3 2d 3d c8 1a a8 ba 02 ad |b.....|.-=......|
+| 5a ac 7f 2a 7c a5 1e 5f dc 7d ed 9d 8b 13 65 b6 |Z..*|.._.}....e.|
+| 87 3d ed 6b 2f 09 c8 52 7e c1 d6 38 44 af fe 7b |.=.k/..R~..8D..{|
+| fb e1 40 de c2 b6 a5 6b 9e 0e 25 3e 43 57 73 3d |..@....k..%>CWs=|
+| a6 21 e4 c8 da 84 7e d2 1a ff 25 53 e8 33 98 19 |.!....~...%S.3..|
+| d3 94 c9 2a f5 8d a9 fe 4e b7 3c c3 3c 1c fa cf |...*....N.<.<...|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e a7 1c |n.nl'</script>..|
+| e7 d5 d3 39 cd c6 05 e0 4b 2a 7d b9 03 d2 bf 66 |...9....K*}....f|
+| 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00 0d |................|
+ssl_decrypt_record found padding 13 final len 370
+checking mac (len 350, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4482 found 0x345da50
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x345da50
+
+dissect_ssl enter frame #460 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ff 47 73 57 c4 1b 72 4b 85 a6 0a 28 c0 84 8f e0 |.GsW..rK...(....|
+| 44 c9 91 69 3e b7 13 ab 1e 46 d8 c7 f8 61 2b 15 |D..i>....F...a+.|
+Plaintext[32]:
+| 01 00 65 bd aa 5e 0e 3e b6 fe b8 48 09 58 37 a0 |..e..^.>...H.X7.|
+| 8f 09 90 a7 f9 04 00 00 00 00 00 00 00 00 00 09 |................|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #462 (first time)
+ conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 65 e3 b2 c5 bc 2b 1c 7d 72 79 35 53 34 8b 5e ac |e....+.}ry5S4.^.|
+| 67 d2 93 7f 23 03 14 67 6a 24 6d 66 67 b9 5a 3f |g...#..gj$mfg.Z?|
+Plaintext[32]:
+| 01 00 2c 3c 1f 04 39 71 f0 aa f0 96 ab 9a 05 41 |..,<..9q.......A|
+| 3e cd d4 36 85 61 00 00 00 00 00 00 00 00 00 09 |>..6.a..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #467 (first time)
+ssl_session_init: initializing ptr 0x7f265a9736c0 size 688
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 42282 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4483
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #469 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 763
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC007 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 677
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 192
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 178, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754
+ record: offset = 754, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763
+
+dissect_ssl enter frame #471 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 146
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0...
+looking for RSA pre-master410450e94aaac0f7210244abddfdfb0f19b8595d0168eda3...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| c9 78 f8 5d 27 64 c2 ea bc 48 bf 2d d7 02 0a 1f |.x.]'d...H.-....|
+| 57 35 a5 cb d4 c1 c1 c5 fd 6c 82 59 ac ac 31 24 |W5.......l.Y..1$|
+| 96 f6 17 cd 8f 6e 2f b5 00 4a 0b f7 9a 1a 3c d9 |.....n/..J....<.|
+| 9c 20 d7 28 7b 4c ad 51 9b ad d8 be 43 08 bb 71 |. .({L.Q....C..q|
+| 98 13 58 dd 71 16 71 51 |..X.q.qQ |
+Client MAC key[20]:
+| c9 78 f8 5d 27 64 c2 ea bc 48 bf 2d d7 02 0a 1f |.x.]'d...H.-....|
+| 57 35 a5 cb |W5.. |
+Server MAC key[20]:
+| d4 c1 c1 c5 fd 6c 82 59 ac ac 31 24 96 f6 17 cd |.....l.Y..1$....|
+| 8f 6e 2f b5 |.n/. |
+Client Write key[16]:
+| 00 4a 0b f7 9a 1a 3c d9 9c 20 d7 28 7b 4c ad 51 |.J....<.. .({L.Q|
+Server Write key[16]:
+| 9b ad d8 be 43 08 bb 71 98 13 58 dd 71 16 71 51 |....C..q..X.q.qQ|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| e0 65 76 03 00 00 00 00 |.ev..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 07 00 d9 24 de cc ec 1a 6b d5 5a ee ef f6 55 cc |...$....k.Z...U.|
+| c2 c2 36 88 50 f6 c1 30 6a bd 53 56 df 5f 80 62 |..6.P..0j.SV._.b|
+ssl_save_session stored master secret[48]:
+| 46 75 96 42 7d 0f 4f e4 40 d0 02 de 21 59 3b 8d |Fu.B}.O.@...!Y;.|
+| 9b 01 fe 08 cc 75 2f a9 61 fb 8a 55 f5 da 73 c6 |.....u/.a..U..s.|
+| aa 36 c9 af 4d 22 bb 37 1d bf 9b b5 c5 07 66 ef |.6..M".7......f.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| e7 67 f3 fc ff b1 11 eb e0 05 92 38 90 50 62 91 |.g.........8.Pb.|
+| 89 d0 56 04 91 bc da d7 70 83 a2 0a 70 e7 50 db |..V.....p...p.P.|
+| 5a 45 6c de e8 69 38 f1 fb d7 20 c0 c1 ee 4d 34 |ZEl..i8... ...M4|
+| 36 be 04 28 2d 80 b0 b3 58 26 c1 d6 |6..(-...X&.. |
+Plaintext[60]:
+| 14 00 00 24 4a 60 ff 91 65 5d 27 f1 f2 97 25 c0 |...$J`..e]'...%.|
+| b4 f2 b1 66 90 36 9a 52 e8 24 fb 1c 7c 5e c0 66 |...f.6.R.$..|^.f|
+| 2b 74 37 f2 86 60 f4 0c 4f 52 39 a0 97 93 bf 39 |+t7..`..OR9....9|
+| 14 b7 64 a6 9e e1 31 7e f8 27 63 c1 |..d...1~.'c. |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #472 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| 65 de 70 e2 8d df 63 38 d8 76 17 aa 26 8c 7c 4a |e.p...c8.v..&.|J|
+| 2b 07 5d 64 8c b8 be 5a 9f 38 18 32 28 ab 4c 29 |+.]d...Z.8.2(.L)|
+| ed 69 fb 57 26 a0 35 be fc c3 65 cf 8f 12 be ca |.i.W&.5...e.....|
+| 37 ee e9 2b b4 c0 a5 bf 29 1b 25 bf |7..+....).%. |
+Plaintext[60]:
+| 14 00 00 24 e1 ee 0c c3 1a 3c c7 6c eb 52 9d 7c |...$.....<.l.R.||
+| 48 0f 2b ce d1 0d 73 c0 b2 37 5d cf 15 03 5c 44 |H.+...s..7]...\D|
+| 6c 0d 06 33 bc 45 09 dc 2b 43 1e c3 6d eb 65 cf |l..3.E..+C..m.e.|
+| 84 1e cf 57 0c 8c d8 fb 2c e9 78 3e |...W....,.x> |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #473 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 98
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 93, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 93
+Ciphertext[93]:
+| 49 26 88 96 1e 47 35 a3 03 ca 92 ea c5 02 99 b7 |I&...G5.........|
+| e0 9d 54 9a bf 1d a4 4d 86 f8 0e 0c 8c 5c d0 93 |..T....M.....\..|
+| d1 9c f7 bf 6c 13 69 6e c6 1e bd e9 90 11 dc 09 |....l.in........|
+| df 2c f0 ca e2 3b ed dc fe 48 0e 23 7e bb dc 2b |.,...;...H.#~..+|
+| 55 68 d6 b8 71 cb 80 1c 94 84 c2 66 e1 ad fe 87 |Uh..q......f....|
+| 4f dd cd b1 d7 da ac 63 b0 e5 64 76 84 |O......c..dv. |
+Plaintext[93]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a 28 d7 41 c2 ab 3c f0 |:4483....(.A..<.|
+| 23 b2 a5 ad 00 87 29 33 43 41 24 af b6 |#.....)3CA$.. |
+checking mac (len 73, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73
+association_find: TCP port 42282 found (nil)
+association_find: TCP port 4483 found 0x345dae0
+dissect_ssl3_record decrypted len 73
+decrypted app data fragment[73]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a |:4483.... |
+dissect_ssl3_record found association 0x345dae0
+
+dissect_ssl enter frame #474 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 374
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 369, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 369
+Ciphertext[369]:
+| b4 11 97 89 51 fa 8b ba e8 ed 1b a7 92 ff 2e e8 |....Q...........|
+| 3b 2f 3e 2d a5 7e c2 4c fa 69 03 8f ee 96 fe cf |;/>-.~.L.i......|
+| ff 27 04 92 b1 95 9f 31 c4 a1 64 1b 0d 46 42 71 |.'.....1..d..FBq|
+| 5d 07 17 e0 d2 ab ff 91 72 93 df 26 1e 4a e1 05 |].......r..&.J..|
+| 17 8e 9d 1d 72 0b 17 6e c5 53 34 13 d3 53 5a 67 |....r..n.S4..SZg|
+| e3 8d 50 f7 9d 37 41 c1 55 fd a3 ff 0a df fa 67 |..P..7A.U......g|
+| 64 33 02 03 e9 8d c5 e7 9e 17 55 9a 8e d1 6f 63 |d3........U...oc|
+| 7a b1 0b b7 af f7 7a 79 14 2c 30 5d 44 ea 03 e0 |z.....zy.,0]D...|
+| 11 03 1e 49 91 ff 7e 19 a7 b8 23 cc 14 c4 c4 9c |...I..~...#.....|
+| f5 64 08 2a 03 28 fc d9 c3 00 8a 81 07 2c 36 67 |.d.*.(.......,6g|
+| 53 e7 f4 a6 ae fd c8 15 7d 62 24 65 d5 ee e3 bc |S.......}b$e....|
+| ce 57 29 80 90 81 87 91 60 a8 5b 4a d2 3e b1 3d |.W).....`.[J.>.=|
+| 98 47 eb 80 40 69 f6 48 f0 37 59 7b c0 e2 be 42 |.G..@i.H.7Y{...B|
+| 1e 33 18 1f a6 a7 a4 00 4a 42 b6 95 09 fd 6a 47 |.3......JB....jG|
+| 23 dd 75 4b 8b 3c 78 5b 00 5a 7c 5c 0a 93 69 d1 |#.uK.<x[.Z|\..i.|
+| ec 55 37 52 bb 5d 8d e4 cb 7b 0a ee ba f8 7c 04 |.U7R.]...{....|.|
+| ef 86 3e d9 fe 40 c7 49 2a 5b 1f df 89 6e 0b 94 |..>..@.I*[...n..|
+| db 86 49 65 62 fa 43 52 e1 e8 5d 60 0d 3f 7d 68 |..Ieb.CR..]`.?}h|
+| 01 de a7 c3 4f 56 a6 ac 18 c0 3e da 21 1d c8 40 |....OV....>.!..@|
+| 92 9e 0b 0d 23 dd 68 c8 ca 75 be 73 94 98 80 a8 |....#.h..u.s....|
+| 1b 27 31 15 2f c1 ff 3b 4a e6 7c 68 21 19 6c 3c |.'1./..;J.|h!.l<|
+| da 11 67 df 07 1e 41 21 3c 47 41 7b fe 15 50 9b |..g...A!<GA{..P.|
+| 7c b8 0b de 42 81 ae 15 40 b7 e2 3f 0f 99 5b 2f ||...B...@..?..[/|
+| 63 |c |
+Plaintext[369]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ff 87 5a |.nl'</script>..Z|
+| a4 f1 c2 e7 2a 65 34 aa 22 f4 76 62 29 dc f5 74 |....*e4.".vb)..t|
+| 12 |. |
+checking mac (len 349, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349
+association_find: TCP port 4483 found 0x345dae0
+dissect_ssl3_record decrypted len 349
+decrypted app data fragment[349]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |.nl'</script> |
+dissect_ssl3_record found association 0x345dae0
+
+dissect_ssl enter frame #475 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| e9 cb bf 35 91 a3 f8 4c 59 19 05 b6 6d 97 a1 15 |...5...LY...m...|
+| 13 11 85 95 aa 53 |.....S |
+Plaintext[22]:
+| 01 00 6a ef e6 46 98 b2 ce 07 5d 8a 44 81 b7 82 |..j..F....].D...|
+| 3a b2 22 d8 1b d1 |:."... |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #477 (first time)
+ conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| f9 2e 5a 06 ff 85 74 c2 c8 19 b8 3c 91 a4 4a df |..Z...t....<..J.|
+| 2a 81 c1 72 bb 4a |*..r.J |
+Plaintext[22]:
+| 01 00 fa 0c e0 3b 25 dc f6 5e 66 09 21 d3 39 cb |.....;%..^f.!.9.|
+| ea 91 dc c6 f2 82 |...... |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #482 (first time)
+ssl_session_init: initializing ptr 0x7f265a975dd0 size 688
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 36004 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4484
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #484 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 763
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 677
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 192
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 178, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754
+ record: offset = 754, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763
+
+dissect_ssl enter frame #486 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a86...
+looking for RSA pre-master41041a0c2f48f1e2329f14c836b578df11e10d5f2653f35f...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| bd 19 4e d0 f7 ea 6a ef ab fc 24 f3 74 03 07 c1 |..N...j...$.t...|
+| 96 d5 71 24 0a ae 45 6e 28 0c e5 56 e8 c8 99 3d |..q$..En(..V...=|
+| 13 cc 3d 9b ff 05 dd 60 53 d4 2c 5b 9c 2b 83 87 |..=....`S.,[.+..|
+| 2f e7 bd dc af 61 66 f2 cc 9a b4 7a 9a aa 15 a7 |/....af....z....|
+| 79 d9 11 12 99 1a 11 2c 94 27 8a 25 f3 8f 3e f7 |y......,.'.%..>.|
+| 2b a7 1b 12 68 4e 57 3e 61 23 0c 0c d5 a8 d6 82 |+...hNW>a#......|
+| b4 12 55 66 6a 3d eb 8c |..Ufj=.. |
+Client MAC key[20]:
+| bd 19 4e d0 f7 ea 6a ef ab fc 24 f3 74 03 07 c1 |..N...j...$.t...|
+| 96 d5 71 24 |..q$ |
+Server MAC key[20]:
+| 0a ae 45 6e 28 0c e5 56 e8 c8 99 3d 13 cc 3d 9b |..En(..V...=..=.|
+| ff 05 dd 60 |...` |
+Client Write key[24]:
+| 53 d4 2c 5b 9c 2b 83 87 2f e7 bd dc af 61 66 f2 |S.,[.+../....af.|
+| cc 9a b4 7a 9a aa 15 a7 |...z.... |
+Server Write key[24]:
+| 79 d9 11 12 99 1a 11 2c 94 27 8a 25 f3 8f 3e f7 |y......,.'.%..>.|
+| 2b a7 1b 12 68 4e 57 3e |+...hNW> |
+Client Write IV[8]:
+| 61 23 0c 0c d5 a8 d6 82 |a#...... |
+Server Write IV[8]:
+| b4 12 55 66 6a 3d eb 8c |..Ufj=.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 66 2f 21 b1 49 a6 60 44 7a 63 2c e7 fd 63 9a f2 |f/!.I.`Dzc,..c..|
+| 0a 50 e1 c9 3c 27 8a 54 ba 5b 2e d9 96 06 32 bd |.P..<'.T.[....2.|
+ssl_save_session stored master secret[48]:
+| 17 ac c4 2b 02 81 45 a2 cd 35 a6 4e 82 1f 89 38 |...+..E..5.N...8|
+| 8e 62 51 94 a6 52 e8 8e 82 46 cc 08 9a 7c 51 e4 |.bQ..R...F...|Q.|
+| e0 5f 90 f9 ac fb 5e da 64 a6 33 a3 ef d3 f3 e1 |._....^.d.3.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 31 fe 15 e3 66 78 e6 c6 2b a4 17 8e 8d 1f ee 4f |1...fx..+......O|
+| 7d af fc 1e 1b 6b 3e 02 54 08 5b 3a 30 89 61 f1 |}....k>.T.[:0.a.|
+| fd 97 69 56 9c fa b3 3c c9 2f d0 c4 0d d1 21 b4 |..iV...<./....!.|
+| d1 04 8e f2 fd e4 e1 ae e7 46 c7 61 09 08 1c 3c |.........F.a...<|
+Plaintext[64]:
+| 14 00 00 24 96 5d 44 6e ac 25 2a d4 6e 6f d7 f8 |...$.]Dn.%*.no..|
+| 6c 0c d3 4d d8 f1 6f 42 46 56 48 a0 cc 7b ab fa |l..M..oBFVH..{..|
+| 4f e6 df 4a 0c 2c 4e ae 76 32 36 b0 dc bc 18 f1 |O..J.,N.v26.....|
+| 25 9b 24 97 d2 12 80 85 1b c9 1b da 00 00 00 03 |%.$.............|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #487 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 05 fc ae 66 9a 98 94 a1 5d 34 5b 31 d8 4a 74 d0 |...f....]4[1.Jt.|
+| 1a 34 7d 03 7d 0e 39 8a 88 78 68 fc 28 84 f8 2c |.4}.}.9..xh.(..,|
+| 2b 2c 0c 8d 24 4c ff eb a6 82 f7 d9 d6 67 8a 9b |+,..$L.......g..|
+| 36 a7 ee 34 e1 e1 9d 9c 9c d0 1b 62 24 8e 97 7d |6..4.......b$..}|
+Plaintext[64]:
+| 14 00 00 24 7a c1 ee e2 e3 ce 06 aa a9 8c 5f 71 |...$z........._q|
+| 74 50 9f 94 98 1b f9 40 a5 52 6a e8 9b 17 f6 25 |tP.....@.Rj....%|
+| f6 9d dc 3d 48 63 0f 1e 2f 40 cd b6 d1 e0 3a eb |...=Hc../@....:.|
+| e5 1e c3 a3 c0 94 c1 93 15 46 d6 33 00 00 00 03 |.........F.3....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #488 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 3b 70 27 8a 8d 93 d0 ff 2e 42 47 5c 8d ec 44 e9 |;p'......BG\..D.|
+| cf dd 15 4d 77 b4 25 9e |...Mw.%. |
+Plaintext[24]:
+| c3 80 7a 69 13 34 2e 0f 47 a7 6a c6 6f a2 cd 26 |..zi.4..G.j.o..&|
+| 29 eb 8a b3 00 00 00 03 |)....... |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 36004 found (nil)
+association_find: TCP port 4484 found 0x345db70
+ record: offset = 29, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 6f 68 aa 91 66 45 c2 55 06 c7 0a 1e 4d 23 fb cd |oh..fE.U....M#..|
+| 54 e0 10 19 4e 14 ad 3f 7f 8b 20 d1 a0 a1 9f cf |T...N..?.. .....|
+| 11 d7 ff ae 79 ff a4 3f b7 46 3c f3 1b f5 5a 3a |....y..?.F<...Z:|
+| 94 e7 71 2b 55 d6 22 0b 91 08 7b b1 19 91 0f 2a |..q+U."...{....*|
+| 02 ad 7e 75 4d 6c 9c 24 d8 e9 6c e2 86 ac 54 ee |..~uMl.$..l...T.|
+| 1c 40 db bf be 96 b5 36 e0 13 7e 39 a8 da fa e1 |.@.....6..~9....|
+| 9a 2b 0b 21 dc 65 80 ab |.+.!.e.. |
+Plaintext[104]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c |a-des-cbc3-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 38 34 0d 0a 0d 0a 34 ab |yn.nl:4484....4.|
+| 68 fd 9f 19 71 c3 32 65 37 ba ab 6c d7 bd f8 92 |h...q.2e7..l....|
+| b8 73 00 00 00 00 00 05 |.s...... |
+ssl_decrypt_record found padding 5 final len 98
+checking mac (len 78, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 78, seq = 0, nxtseq = 78
+association_find: TCP port 36004 found (nil)
+association_find: TCP port 4484 found 0x345db70
+dissect_ssl3_record decrypted len 78
+decrypted app data fragment[78]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c |a-des-cbc3-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 38 34 0d 0a 0d 0a |yn.nl:4484.... |
+dissect_ssl3_record found association 0x345db70
+
+dissect_ssl enter frame #489 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| 53 46 11 26 7f 52 f0 c6 05 61 69 e9 6b 96 52 b8 |SF.&.R...ai.k.R.|
+| d0 a6 99 44 61 b8 de 9b cb 6a 49 ff 78 8a 2e 76 |...Da....jI.x..v|
+| 18 78 e9 08 0b f4 5e 9d 7f 38 21 22 3a be 2e 68 |.x....^..8!":..h|
+| 9d 68 83 26 8f 11 23 c6 82 82 dc 7f 51 71 11 b5 |.h.&..#.....Qq..|
+| 32 f6 f9 e5 a4 b3 db b2 29 1b cb 1d f2 14 0e 95 |2.......).......|
+| f3 68 cf 13 69 2a 96 95 f1 e4 87 35 2b 89 0d 93 |.h..i*.....5+...|
+| 38 c4 c7 c4 af f6 85 f0 15 ae 2a f3 52 fb 1f 8e |8.........*.R...|
+| a3 36 40 d7 5e bb 18 78 8f 4f 14 93 fb f7 df 58 |.6@.^..x.O.....X|
+| 13 02 a9 eb bb ae bc c3 57 2c 62 07 2c bf f1 12 |........W,b.,...|
+| ec 99 ea d4 d7 79 c7 34 57 96 dd e3 95 9c 68 70 |.....y.4W.....hp|
+| 7f ff 71 43 5b 05 0f a6 6c 81 e2 76 10 a0 5c f8 |..qC[...l..v..\.|
+| 60 e5 fa bf a2 cb 19 0d cd ed 69 45 fd fd c1 05 |`.........iE....|
+| b5 cf 04 44 57 c0 39 e8 43 69 d6 23 00 f2 75 45 |...DW.9.Ci.#..uE|
+| e5 65 4f 53 d0 7b e0 f9 32 16 9c 7f 91 2e 2e d9 |.eOS.{..2.......|
+| 29 28 8a 55 cd 85 a2 cf b7 de f6 c4 cb 5a 65 af |)(.U.........Ze.|
+| c9 0a 1e 75 6d 6a 9f 19 76 5c 73 a4 28 78 48 73 |...umj..v\s.(xHs|
+| 7b 1b d0 7d e5 d2 7f 72 bb dd db e2 2c 13 53 06 |{..}...r....,.S.|
+| 13 bf 23 d1 d8 05 78 50 e1 42 f0 b7 d9 db 1e 9a |..#...xP.B......|
+| 45 83 4d 16 5b 46 fe 6a 83 f7 dc e4 e7 9d 49 2b |E.M.[F.j......I+|
+| 8f f0 72 5f c7 c8 af 5f 89 c1 b6 8d 9c e2 d2 44 |..r_..._.......D|
+| ed 25 85 1c fb 9e af 7c a9 3a 60 e5 17 1b 55 18 |.%.....|.:`...U.|
+| c0 d8 c6 25 f3 0e 78 0c 5b d3 08 91 2e a1 08 8c |...%..x.[.......|
+| 53 d7 bf 43 8f b7 e3 db 60 b2 12 b7 50 4a 43 13 |S..C....`...PJC.|
+| 37 f5 b7 ae 4e 07 e6 ff |7...N... |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 38 20 2d 20 45 43 44 48 45 |xC0,0x08 - ECDHE|
+| 2d 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d |-ECDSA-DES-CBC3-|
+| 53 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 |SHA SSLv3 Kx=ECD|
+| 48 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 |H Au=ECDSA E|
+| 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 81 da |n.nl'</script>..|
+| b8 c7 9f 5c 70 df 90 11 6f 59 ff 15 85 78 62 af |...\p...oY...xb.|
+| 55 76 00 00 00 00 00 05 |Uv...... |
+ssl_decrypt_record found padding 5 final len 370
+checking mac (len 350, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4484 found 0x345db70
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 38 20 2d 20 45 43 44 48 45 |xC0,0x08 - ECDHE|
+| 2d 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d |-ECDSA-DES-CBC3-|
+| 53 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 |SHA SSLv3 Kx=ECD|
+| 48 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 |H Au=ECDSA E|
+| 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x345db70
+
+dissect_ssl enter frame #490 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 6d 3c 62 53 f7 05 f1 bd bb e2 03 6d 8c 17 6b 04 |m<bS.......m..k.|
+| c9 f8 5f 1f 7d 47 e1 6c |.._.}G.l |
+Plaintext[24]:
+| 01 00 25 18 59 1e 53 70 aa d1 a3 9b b6 4e f0 a6 |..%.Y.Sp.....N..|
+| 07 2c cd b7 2f 06 00 01 |.,../... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #492 (first time)
+ conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 8f e3 6d 53 9f 8f 00 82 d9 e7 88 b8 6a 42 96 62 |..mS........jB.b|
+| a7 18 dd ef 56 29 8f 14 |....V).. |
+Plaintext[24]:
+| 01 00 ce 1d 97 ae b8 57 c5 66 60 b9 8d c0 61 6c |.......W.f`...al|
+| da f8 d8 03 f5 78 00 01 |.....x.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #497 (first time)
+ssl_session_init: initializing ptr 0x7f265a978570 size 688
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 39102 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4485
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #499 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 763
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 677
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 192
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 178, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754
+ record: offset = 754, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763
+
+dissect_ssl enter frame #501 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d...
+looking for RSA pre-master4104c0ef088268c1b47123d937c022c72b4bdabf267180dd...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| b2 78 f3 07 7e 37 30 9d ed b9 08 54 89 04 c2 89 |.x..~70....T....|
+| f6 24 18 9a a7 bb ce b8 77 ac 64 f7 8b 06 ba bb |.$......w.d.....|
+| c9 33 5d c2 e7 53 49 af 21 91 77 97 41 49 8f ba |.3]..SI.!.w.AI..|
+| 69 f3 97 5a d3 37 30 bd 95 1d f1 35 5e 8f 15 e8 |i..Z.70....5^...|
+| 2e 79 6f 79 99 ad 7e 31 36 0a c6 89 7b d2 62 3c |.yoy..~16...{.b<|
+| 4c 30 09 d5 1b d3 0e a4 eb e7 4d 12 e3 68 ff 8a |L0........M..h..|
+| ec e1 89 9e 11 08 7c a8 |......|. |
+Client MAC key[20]:
+| b2 78 f3 07 7e 37 30 9d ed b9 08 54 89 04 c2 89 |.x..~70....T....|
+| f6 24 18 9a |.$.. |
+Server MAC key[20]:
+| a7 bb ce b8 77 ac 64 f7 8b 06 ba bb c9 33 5d c2 |....w.d......3].|
+| e7 53 49 af |.SI. |
+Client Write key[16]:
+| 21 91 77 97 41 49 8f ba 69 f3 97 5a d3 37 30 bd |!.w.AI..i..Z.70.|
+Server Write key[16]:
+| 95 1d f1 35 5e 8f 15 e8 2e 79 6f 79 99 ad 7e 31 |...5^....yoy..~1|
+Client Write IV[16]:
+| 36 0a c6 89 7b d2 62 3c 4c 30 09 d5 1b d3 0e a4 |6...{.b<L0......|
+Server Write IV[16]:
+| eb e7 4d 12 e3 68 ff 8a ec e1 89 9e 11 08 7c a8 |..M..h........|.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| dc 19 51 47 97 d4 10 7b cb 0d 98 2a df be 67 f1 |..QG...{...*..g.|
+| 9d a8 75 75 a7 76 da c2 3c 49 02 89 d3 d8 98 0f |..uu.v..<I......|
+ssl_save_session stored master secret[48]:
+| 4b 7a 19 dd e3 18 71 a9 80 b9 c9 db 28 26 c1 07 |Kz....q.....(&..|
+| 77 e9 01 d1 43 3a 42 40 29 fa 27 03 b1 bc 87 af |w...C:B@).'.....|
+| 05 a7 29 4e 33 27 8f da 43 9f d7 5b 61 e0 d9 13 |..)N3'..C..[a...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 14 b9 3e 07 2f 1e d0 47 df 35 47 69 9c 59 36 6c |..>./..G.5Gi.Y6l|
+| a4 2e c0 ce a7 44 4a 8b 60 92 a0 61 d9 ab 31 e9 |.....DJ.`..a..1.|
+| 60 4d 6e 40 48 8a e8 ce 5f 8f 1c 1a ef 3f 23 3a |`Mn@H..._....?#:|
+| 95 b4 fa a6 d4 24 ed 88 39 be cf df 8d 3f d9 8f |.....$..9....?..|
+Plaintext[64]:
+| 14 00 00 24 d0 c7 5a cd bd 36 94 dd a7 b2 95 c5 |...$..Z..6......|
+| 01 17 3b 24 ae b4 21 0c 8c da 86 23 a1 bc d4 16 |..;$..!....#....|
+| de dc c6 49 7b f8 22 ef d5 55 a7 79 53 23 b5 4d |...I{."..U.yS#.M|
+| f7 28 b5 50 55 d5 36 cf 47 6f 3c a2 00 00 00 03 |.(.PU.6.Go<.....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #502 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 79 69 d0 ef 4d fe 2e 10 6d 64 d2 1c 91 e5 b1 fc |yi..M...md......|
+| 77 79 8c a1 88 72 bf 5d c2 fd e7 28 29 12 a3 6b |wy...r.]...()..k|
+| a0 e5 bf 88 b4 73 36 e8 48 86 b0 e1 f0 cf 1a b8 |.....s6.H.......|
+| 89 65 a4 87 ce 37 a6 59 de 54 e1 bd 9b 5f 0b 7b |.e...7.Y.T..._.{|
+Plaintext[64]:
+| 14 00 00 24 56 cb 2f 3f 36 86 7e 03 47 00 ee 82 |...$V./?6.~.G...|
+| 7e ec 5d 40 61 11 3c 22 ec 0f 89 69 bc 0e a2 3e |~.]@a.<"...i...>|
+| 9f 2d b6 58 29 74 f4 1f f6 af 92 75 10 27 2f 75 |.-.X)t.....u.'/u|
+| 62 9e cc 94 52 3a 0d 83 df 72 c3 99 00 00 00 03 |b...R:...r......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #503 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| f0 0c 46 79 12 41 53 93 56 a3 4a 45 d5 c2 2e e4 |..Fy.AS.V.JE....|
+| 1d 06 3a dd 14 eb 71 db c4 11 ce 88 50 d5 a7 2f |..:...q.....P../|
+Plaintext[32]:
+| 1f ce 5d 7e 40 0c ff 25 9a de eb 19 99 35 78 0f |..]~@..%.....5x.|
+| 00 e5 22 16 00 00 00 00 00 00 00 00 00 00 00 0b |..".............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 39102 found (nil)
+association_find: TCP port 4485 found 0x345dc00
+ record: offset = 37, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a5 0c a3 c2 6d a4 ca be 5c a4 f3 13 6a bf a0 41 |....m...\...j..A|
+| 76 18 0d 72 63 0a ca 8c 7d 85 b1 e2 ca 88 2c 22 |v..rc...}.....,"|
+| 27 80 0a ab 0e e2 42 4c ca 7c 09 c4 b5 36 14 04 |'.....BL.|...6..|
+| 0e 43 96 5c 95 4b a8 8e 78 59 b2 02 e8 ae 54 9f |.C.\.K..xY....T.|
+| 40 26 3e bf ca 8a 3b b9 c9 87 de a2 83 ed 55 ec |@&>...;.......U.|
+| 98 08 6f 16 9f ee a6 9c 7a a4 13 88 70 2f 77 2f |..o.....z...p/w/|
+| 51 94 ec 68 eb db a7 77 fd ff ee 84 4f c9 72 2e |Q..h...w....O.r.|
+Plaintext[112]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a d0 2e dd f3 |.nl:4485........|
+| 8f c4 3f d5 21 59 6c 70 63 e7 16 96 50 e2 9c 74 |..?.!Ylpc...P..t|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 96
+checking mac (len 76, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 76, seq = 0, nxtseq = 76
+association_find: TCP port 39102 found (nil)
+association_find: TCP port 4485 found 0x345dc00
+dissect_ssl3_record decrypted len 76
+decrypted app data fragment[76]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a |.nl:4485.... |
+dissect_ssl3_record found association 0x345dc00
+
+dissect_ssl enter frame #504 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 30 cd 30 21 02 b2 00 fe ad 87 fa 9a 29 16 36 4e |0.0!........).6N|
+| 09 30 a4 09 c3 c6 9e 04 a0 2c b1 95 09 33 c2 b5 |.0.......,...3..|
+| ef 1d 3f 6b 06 4a fc 51 ac 18 5b 44 ef c4 4e ad |..?k.J.Q..[D..N.|
+| df 88 54 a2 37 61 86 18 63 df 87 40 e5 2a ba e6 |..T.7a..c..@.*..|
+| 81 69 21 16 20 c8 d8 57 65 e2 13 8b 63 b8 cb e6 |.i!. ..We...c...|
+| 54 e1 92 d2 e7 bf ba bf 72 79 69 a5 a2 47 ce 61 |T.......ryi..G.a|
+| 45 e0 f1 3b 68 f0 11 a0 86 fa 23 8f c9 63 d5 98 |E..;h.....#..c..|
+| 15 7f 2c 3d 85 27 7c ce 79 ab fb c1 ad 3e 8b 95 |..,=.'|.y....>..|
+| da bc dd a3 65 57 b3 55 19 f1 53 96 4f 20 0e f9 |....eW.U..S.O ..|
+| 4f 8f 5d 99 63 c5 3e df 5b f5 fd bc bd bf 42 20 |O.].c.>.[.....B |
+| 67 03 6e f5 15 c7 6d 33 03 68 25 71 4d c5 14 cd |g.n...m3.h%qM...|
+| a3 a8 1f bc 93 97 fd 01 e1 3d eb 77 16 7b ef 9d |.........=.w.{..|
+| c0 50 56 32 d9 5f 90 3b a1 25 30 6d c6 59 2b 3f |.PV2._.;.%0m.Y+?|
+| 84 b8 9e a8 f6 be 19 8b fb b9 e8 f6 37 fc 40 5b |............7.@[|
+| 06 54 48 e4 ce 38 e4 5f 50 f5 e2 c4 3b 52 bb da |.TH..8._P...;R..|
+| 86 a5 5e b1 c4 cc 57 22 77 29 9c 49 58 d6 f9 93 |..^...W"w).IX...|
+| 0f 7d b7 df 21 3a 9c ca 6e d0 d2 6b 15 83 b8 fb |.}..!:..n..k....|
+| dc cc 79 8b 5f fc c7 41 13 5a e6 cb cf c0 f6 7f |..y._..A.Z......|
+| 44 66 bf 02 57 0a 09 60 e8 3f e7 07 61 95 ff e0 |Df..W..`.?..a...|
+| d0 6e ff 95 d4 d0 15 d5 9e 4b 59 73 01 96 7b c3 |.n.......KYs..{.|
+| 9e 29 09 e4 54 f7 41 69 45 78 60 0d 92 28 b1 ff |.)..T.AiEx`..(..|
+| cd 6d 10 c0 ca c0 61 17 0b 49 e2 8f 2e 5c 0a 05 |.m....a..I...\..|
+| ed 31 ec 20 79 b6 57 dc 48 7c 25 fd 28 aa 18 ef |.1. y.W.H|%.(...|
+| 74 49 a5 f1 4c 89 1d b0 d9 92 cb 11 b5 b8 f1 73 |tI..L..........s|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ad 70 58 |.nl'</script>.pX|
+| fb f3 1a 47 ea 92 42 c4 4f d6 0f ec 2a 12 0e 34 |...G..B.O...*..4|
+| a1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................|
+ssl_decrypt_record found padding 14 final len 369
+checking mac (len 349, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349
+association_find: TCP port 4485 found 0x345dc00
+dissect_ssl3_record decrypted len 349
+decrypted app data fragment[349]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |.nl'</script> |
+dissect_ssl3_record found association 0x345dc00
+
+dissect_ssl enter frame #505 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 88 31 7c 7b 2f e7 98 b0 fb 69 1c 40 55 1a f3 d4 |.1|{/....i.@U...|
+| 46 86 22 4c 2d 26 9f 0b e4 0e d0 a8 f0 ee 9a 3e |F."L-&.........>|
+Plaintext[32]:
+| 01 00 c1 06 87 d9 9d 85 07 39 3f 57 4e c1 ac 1a |.........9?WN...|
+| bf ec 9c 65 e4 4e 00 00 00 00 00 00 00 00 00 09 |...e.N..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #507 (first time)
+ conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 30 bd 30 0f 09 a5 a9 c7 6a 41 cf 8d 41 e4 04 45 |0.0.....jA..A..E|
+| c9 4a 15 c4 68 06 a1 2d 60 cf da ba 4f cc 5c f6 |.J..h..-`...O.\.|
+Plaintext[32]:
+| 01 00 0c e8 b5 07 a2 17 ab 24 93 a1 85 f5 a3 bf |.........$......|
+| ab 0e ca 87 41 ef 00 00 00 00 00 00 00 00 00 09 |....A...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #512 (first time)
+ssl_session_init: initializing ptr 0x7f265a97ad10 size 688
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 47638 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4486
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #514 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 763
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 677
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571
+ record: offset = 571, reported_length_remaining = 192
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 178, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754
+ record: offset = 754, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763
+
+dissect_ssl enter frame #516 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076...
+looking for RSA pre-master41043e482f50f1441b7ae7f11a591a27912a4dae82a18703...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| 71 f9 5e 06 cd 40 97 ee 81 ae da 38 03 ad bd 00 |q.^..@.....8....|
+| 9c 93 29 b8 c5 3f 5f 2e 51 0d f6 4a b1 75 f2 e2 |..)..?_.Q..J.u..|
+| 43 52 ad 74 1a d8 7a af 02 f0 35 fe 5a 06 54 d7 |CR.t..z...5.Z.T.|
+| 35 04 07 3d 0d 98 1a 86 06 83 41 9a 9a cd ab fd |5..=......A.....|
+| a5 db c0 44 d2 e0 3d 95 05 bd 63 dc 57 49 67 4b |...D..=...c.WIgK|
+| 3e cd 13 78 0b a9 38 ec 18 80 49 8f 00 0d e1 1e |>..x..8...I.....|
+| 6a 58 da a6 3f d0 a2 84 74 88 48 da 1c 16 07 8a |jX..?...t.H.....|
+| 07 2a 40 be 5c 1d 33 aa ad 06 0e 78 de 79 94 6f |.*@.\.3....x.y.o|
+| 9e a4 cb 1d 60 3b 84 06 |....`;.. |
+Client MAC key[20]:
+| 71 f9 5e 06 cd 40 97 ee 81 ae da 38 03 ad bd 00 |q.^..@.....8....|
+| 9c 93 29 b8 |..). |
+Server MAC key[20]:
+| c5 3f 5f 2e 51 0d f6 4a b1 75 f2 e2 43 52 ad 74 |.?_.Q..J.u..CR.t|
+| 1a d8 7a af |..z. |
+Client Write key[32]:
+| 02 f0 35 fe 5a 06 54 d7 35 04 07 3d 0d 98 1a 86 |..5.Z.T.5..=....|
+| 06 83 41 9a 9a cd ab fd a5 db c0 44 d2 e0 3d 95 |..A........D..=.|
+Server Write key[32]:
+| 05 bd 63 dc 57 49 67 4b 3e cd 13 78 0b a9 38 ec |..c.WIgK>..x..8.|
+| 18 80 49 8f 00 0d e1 1e 6a 58 da a6 3f d0 a2 84 |..I.....jX..?...|
+Client Write IV[16]:
+| 74 88 48 da 1c 16 07 8a 07 2a 40 be 5c 1d 33 aa |t.H......*@.\.3.|
+Server Write IV[16]:
+| ad 06 0e 78 de 79 94 6f 9e a4 cb 1d 60 3b 84 06 |...x.y.o....`;..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| a5 3a 9f c6 44 1d 5a 69 ac f7 5f f7 9e f2 38 ed |.:..D.Zi.._...8.|
+| 03 9c 7e b3 d5 0b 3c 14 ad 0d 05 1e f7 bc 64 13 |..~...<.......d.|
+ssl_save_session stored master secret[48]:
+| c3 72 9d 1a 5d 65 6d df 61 b6 f9 96 71 77 3f 20 |.r..]em.a...qw? |
+| 32 66 05 d5 59 8d c9 3b 0a fa d3 52 70 cb 20 b8 |2f..Y..;...Rp. .|
+| ea d4 fb 3d 8c 84 e7 f6 cf f1 39 f8 45 75 b6 5c |...=......9.Eu.\|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 7d 5a 5f 6a 5e d0 28 49 b5 e5 10 e6 0d 11 f4 48 |}Z_j^.(I.......H|
+| 5c 1f c1 86 98 64 14 b5 59 9b e2 ee 2f 8a 9a 3e |\....d..Y.../..>|
+| ca d7 6e bb 04 3e 8a f7 d6 69 5e 4d 43 51 5f 74 |..n..>...i^MCQ_t|
+| 63 18 5e f9 2f cc 5e 9e ff 78 5b 09 87 21 91 c3 |c.^./.^..x[..!..|
+Plaintext[64]:
+| 14 00 00 24 48 7f e3 65 c5 b5 de 86 1d e6 62 66 |...$H..e......bf|
+| 7d 8f 2d 6a cc 84 15 b8 23 1a bc c4 a9 9c f9 8b |}.-j....#.......|
+| 03 ce cd ca 9b 16 db 73 57 7e 01 1a 1f eb b6 04 |.......sW~......|
+| 96 bb 99 45 86 34 62 b8 55 d2 e8 69 00 00 00 03 |...E.4b.U..i....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #517 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a3 30 5c a5 a3 18 56 90 53 5c ff 57 36 3a b8 fe |.0\...V.S\.W6:..|
+| f5 e7 f1 9b 39 af 25 e0 87 a3 f1 84 98 f7 64 ed |....9.%.......d.|
+| 52 ab 4b 37 62 95 af 54 e2 fa fc 37 c1 eb e0 e9 |R.K7b..T...7....|
+| 94 71 0e 67 58 74 c6 50 91 5b 7d 2e 48 d3 fa 39 |.q.gXt.P.[}.H..9|
+Plaintext[64]:
+| 14 00 00 24 17 65 20 47 0e 73 a7 1f 8c 2e 22 3e |...$.e G.s....">|
+| 1a 2b c8 52 7a 7d f1 ec ef 09 00 fe 9e 84 37 c1 |.+.Rz}........7.|
+| 55 7d de c7 49 bc 1f 13 4d dd 0b 1b 79 9d 93 b6 |U}..I...M...y...|
+| e2 a6 88 4f 29 42 c3 90 94 47 fb b5 00 00 00 03 |...O)B...G......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #518 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 43 67 52 72 e5 0a 0d 3c 34 b2 84 e2 b7 7f 21 e0 |CgRr...<4.....!.|
+| fb 2c 58 a0 8f dc c8 f5 ad b7 09 89 95 58 49 67 |.,X..........XIg|
+Plaintext[32]:
+| 8e dc 88 24 7f 72 fe 6c b7 f1 d9 fd d2 0e 23 5f |...$.r.l......#_|
+| a8 6b 20 6d 00 00 00 00 00 00 00 00 00 00 00 0b |.k m............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 47638 found (nil)
+association_find: TCP port 4486 found 0x345dc90
+ record: offset = 37, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 42 8b f6 f0 a3 c2 85 26 70 81 a9 76 e0 81 34 bd |B......&p..v..4.|
+| b5 b3 91 b5 61 91 ef 55 1e 5e 4b c2 1f 94 95 73 |....a..U.^K....s|
+| fb 94 e9 26 f9 1e 96 df ff 90 ef ef fa 4e ab 12 |...&.........N..|
+| e7 be e0 2c 69 e9 9b 64 55 c8 b6 b5 f6 d2 94 02 |...,i..dU.......|
+| b3 43 40 72 81 d3 04 55 0e c4 59 65 02 c1 c5 25 |.C@r...U..Ye...%|
+| 6e 18 af 20 ff 3a 94 6f 11 e2 00 6e 28 a6 6a 8a |n.. .:.o...n(.j.|
+| fe d4 e3 ef dd 12 4e 26 87 e3 92 d2 31 55 61 3f |......N&....1Ua?|
+Plaintext[112]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a aa 44 ba d2 |.nl:4486.....D..|
+| 8a f2 13 34 87 79 24 cc 41 64 65 e3 86 4d 10 89 |...4.y$.Ade..M..|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 96
+checking mac (len 76, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 76, seq = 0, nxtseq = 76
+association_find: TCP port 47638 found (nil)
+association_find: TCP port 4486 found 0x345dc90
+dissect_ssl3_record decrypted len 76
+decrypted app data fragment[76]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a |.nl:4486.... |
+dissect_ssl3_record found association 0x345dc90
+
+dissect_ssl enter frame #519 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 14 50 8e 31 b8 7b c8 23 94 59 8b 79 6d 61 b2 8d |.P.1.{.#.Y.yma..|
+| 5b d2 4b e4 23 73 b8 0e b1 c9 b4 b2 88 e8 eb 86 |[.K.#s..........|
+| 06 32 3f 5c 51 b7 4b 15 9e a1 59 e7 2a 51 ba d6 |.2?\Q.K...Y.*Q..|
+| 0a 52 65 33 00 20 0c d9 a8 e4 68 47 72 cf 5e 3f |.Re3. ....hGr.^?|
+| ff 71 7e db be 8d c5 04 b6 f3 39 11 0e 85 3d 93 |.q~.......9...=.|
+| 1e 40 8e 8d 63 54 89 82 d1 18 2d ae e8 f4 63 df |.@..cT....-...c.|
+| 5e b2 f8 cd d7 f5 af be d8 a6 ce 3a f7 10 dc a5 |^..........:....|
+| f7 e0 90 55 9b 6b 11 d5 72 38 f9 27 6f a5 08 fb |...U.k..r8.'o...|
+| 81 be d9 67 b5 e2 fd 14 ec 11 79 5d 95 7c ee 00 |...g......y].|..|
+| ba 00 cc b4 27 eb 0a 5f 32 20 5a 03 80 d6 d5 a8 |....'.._2 Z.....|
+| 9c 43 30 65 2c 42 33 84 b3 7b 8c 59 b5 59 37 01 |.C0e,B3..{.Y.Y7.|
+| 95 61 ba 63 d5 f0 8f 21 37 98 a9 6d 3d 51 fc 40 |.a.c...!7..m=Q.@|
+| 9d a7 a2 d7 fe 4a 8d 34 e7 aa cc d1 88 69 6c ca |.....J.4.....il.|
+| 00 43 29 01 2a 6e 96 39 c2 94 ad 48 a9 33 c0 58 |.C).*n.9...H.3.X|
+| d3 1d b8 f5 d3 cd e7 01 23 15 b7 1d 9e fd 77 08 |........#.....w.|
+| 03 72 16 3d d1 53 fb 30 85 25 57 87 bc a6 a6 1d |.r.=.S.0.%W.....|
+| 37 ae 8f 63 e5 ce 20 9e a5 75 38 71 34 18 1b c5 |7..c.. ..u8q4...|
+| ea 9f 3e 85 da 4c 30 6c ad f9 f3 1f 01 37 4f 4a |..>..L0l.....7OJ|
+| a6 61 42 55 8c 09 e9 4b 0c c1 ff 10 66 43 7a 9a |.aBU...K....fCz.|
+| 36 20 20 7b e7 31 a3 47 5c 48 16 94 ff 10 23 70 |6 {.1.G\H....#p|
+| dd 79 38 1b 87 e7 5f a0 fb 4f 03 5b f1 26 43 5f |.y8..._..O.[.&C_|
+| d7 f2 f9 31 5e 42 dc 39 28 25 f8 6a ec d7 68 95 |...1^B.9(%.j..h.|
+| 46 ec b9 37 77 a1 c2 16 e0 10 17 ed 81 da 42 65 |F..7w.........Be|
+| 35 1d d8 ee 10 8d ea d6 e8 13 5f 71 7a b7 58 b6 |5........._qz.X.|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 19 53 6e |.nl'</script>.Sn|
+| 63 e8 99 3a 1a ab ea c6 df 13 2c 0c 6f c9 7c 2e |c..:......,.o.|.|
+| 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |R...............|
+ssl_decrypt_record found padding 14 final len 369
+checking mac (len 349, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349
+association_find: TCP port 4486 found 0x345dc90
+dissect_ssl3_record decrypted len 349
+decrypted app data fragment[349]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |.nl'</script> |
+dissect_ssl3_record found association 0x345dc90
+
+dissect_ssl enter frame #520 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 5c 59 e1 95 5a 56 f6 24 6d 18 fe 45 5f 4c 3b a7 |\Y..ZV.$m..E_L;.|
+| 6c 6f aa 2a 0e 9e b6 fc 13 69 52 fc 8c 1c 06 ec |lo.*.....iR.....|
+Plaintext[32]:
+| 01 00 ea b4 f7 90 5f c3 30 8a b6 b6 bf f4 f5 19 |......_.0.......|
+| 15 20 82 1a 40 da 00 00 00 00 00 00 00 00 00 09 |. ..@...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #522 (first time)
+ conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 50 3c 92 91 12 43 df 88 cf 32 d5 56 ad 1e cb ff |P<...C...2.V....|
+| 33 cd 48 06 ff af 5e e4 3f 3a a9 f9 fb 27 fb 42 |3.H...^.?:...'.B|
+Plaintext[32]:
+| 01 00 6e 8f f2 c4 4a dc b5 6d d6 87 44 0c b6 8a |..n...J..m..D...|
+| 48 1b 6d 65 df 31 00 00 00 00 00 00 00 00 00 09 |H.me.1..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #527 (first time)
+ssl_session_init: initializing ptr 0x7f265a97d4b0 size 688
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 56973 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4491
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #529 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 1243
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC011 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1157
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 345
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 331, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234
+ record: offset = 1234, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243
+
+dissect_ssl enter frame #531 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 146
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e...
+looking for RSA pre-master41047af1c204389b48a0422e0249bf82288f6d97c4cd9076...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+key expansion[72]:
+| 00 68 8b b0 e4 3a f4 14 1e 6c 3e e0 b9 a6 4c 20 |.h...:...l>...L |
+| b7 ea 26 40 4a 05 84 0f 33 1c 56 76 29 6f bd ca |..&@J...3.Vv)o..|
+| 51 44 e5 bf 41 14 71 22 ca 9d a8 38 56 fd 47 ec |QD..A.q"...8V.G.|
+| 47 24 05 e5 8c c4 e2 7a 83 46 ff 7d d0 be 6f ca |G$.....z.F.}..o.|
+| a3 47 51 d0 dc 45 c2 1e |.GQ..E.. |
+Client MAC key[20]:
+| 00 68 8b b0 e4 3a f4 14 1e 6c 3e e0 b9 a6 4c 20 |.h...:...l>...L |
+| b7 ea 26 40 |..&@ |
+Server MAC key[20]:
+| 4a 05 84 0f 33 1c 56 76 29 6f bd ca 51 44 e5 bf |J...3.Vv)o..QD..|
+| 41 14 71 22 |A.q" |
+Client Write key[16]:
+| ca 9d a8 38 56 fd 47 ec 47 24 05 e5 8c c4 e2 7a |...8V.G.G$.....z|
+Server Write key[16]:
+| 83 46 ff 7d d0 be 6f ca a3 47 51 d0 dc 45 c2 1e |.F.}..o..GQ..E..|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 65 76 03 00 00 00 00 |@ev..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| cd d3 63 76 fe a8 df 9d d9 26 e1 6d 79 da d2 ec |..cv.....&.my...|
+| 61 d1 4f e3 4f 7b 3a 99 74 47 75 cd 79 95 6d 1c |a.O.O{:.tGu.y.m.|
+ssl_save_session stored master secret[48]:
+| 53 ab 43 c6 af 0e c9 5e 92 90 10 56 cd 7c 13 25 |S.C....^...V.|.%|
+| 6f 74 c6 5c e7 ad e7 50 d5 02 cb cd 76 0b 95 82 |ot.\...P....v...|
+| 7a b7 80 19 3d 12 58 aa da c8 7c c2 44 77 ce 56 |z...=.X...|.Dw.V|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| f6 da 99 f7 b1 e3 6e a8 ee f9 c6 cf eb 65 c0 9c |......n......e..|
+| b4 b3 88 55 13 0b b3 ed ac eb bf 5f 09 6e 0c b8 |...U......._.n..|
+| 6a 75 c1 29 7b c0 64 1d 36 0a a4 5e 65 ae f1 95 |ju.){.d.6..^e...|
+| b4 6e 05 4a 8b 34 4d 91 67 cd d2 a1 |.n.J.4M.g... |
+Plaintext[60]:
+| 14 00 00 24 c9 7b 69 f1 be cd 31 90 7e c9 b9 4e |...$.{i...1.~..N|
+| f6 3d 12 fb 4b 61 ea 80 4e e5 b7 3a e9 bc e6 6e |.=..Ka..N..:...n|
+| c5 aa 59 f4 ed 3e 1f 8d cd da 4a 93 a3 5d bf 49 |..Y..>....J..].I|
+| ba a5 5b 4f 14 53 77 c2 78 ef 16 1f |..[O.Sw.x... |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #532 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 71
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 65
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 60, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 60
+Ciphertext[60]:
+| 84 92 29 82 33 87 1b 0d 60 5c e1 a8 d1 90 fe e2 |..).3...`\......|
+| c0 d9 b2 7c c1 9a 1f 1d 61 68 fc eb b3 12 00 ac |...|....ah......|
+| 9e cf d6 d9 0f f6 81 26 56 eb 4f ec 6f 43 08 05 |.......&V.O.oC..|
+| 25 3f 82 c2 55 4b 56 0f c8 7c 21 0b |%?..UKV..|!. |
+Plaintext[60]:
+| 14 00 00 24 f8 08 1e bf 20 a7 de 75 18 1b ca b4 |...$.... ..u....|
+| de 3c 9f 12 60 74 0a 8f 79 27 53 99 81 f8 a3 4b |.<..`t..y'S....K|
+| a4 7d 8f 3c 96 1a 45 4b 9a c8 6f 29 64 02 bd 61 |.}.<..EK..o)d..a|
+| fd eb 5a cd e6 7c 92 be fe 70 83 3f |..Z..|...p.? |
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #533 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 96
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 91, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 91
+Ciphertext[91]:
+| 45 f4 86 2b 21 bd 98 3b c1 39 dc 8e 43 df c3 6f |E..+!..;.9..C..o|
+| 67 be 75 43 46 d5 5c cd 23 a8 96 b1 f2 80 6a e4 |g.uCF.\.#.....j.|
+| 09 a7 b1 1d dc 6c ec 36 33 30 bd b2 0a bd 66 e5 |.....l.630....f.|
+| 8d da fc a1 4c 83 dc 77 28 3c 85 ca e4 37 4a 45 |....L..w(<...7JE|
+| 0e 43 d3 4c 5b 94 41 26 3f 8e 1a f2 78 55 d8 79 |.C.L[.A&?...xU.y|
+| ae 50 4e 9c 3f dc 62 01 cf 04 43 |.PN.?.b...C |
+Plaintext[91]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a 4d e9 22 0d fc f0 d9 f1 46 |491....M.".....F|
+| 70 65 65 65 a0 f6 db 10 68 f1 9a |peee....h.. |
+checking mac (len 71, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 71, seq = 0, nxtseq = 71
+association_find: TCP port 56973 found (nil)
+association_find: TCP port 4491 found 0x345e560
+dissect_ssl3_record decrypted len 71
+decrypted app data fragment[71]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a |491.... |
+dissect_ssl3_record found association 0x345e560
+
+dissect_ssl enter frame #534 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| eb c9 b7 c3 72 a5 1e 67 1a 95 1e 97 7c 68 cf 53 |....r..g....|h.S|
+| 49 7e 17 dd a6 4f ce 82 37 f6 cd e5 d3 22 f9 5d |I~...O..7....".]|
+| 39 e3 c5 bb f5 58 e0 3f be d3 e7 b5 b6 ea 3b 98 |9....X.?......;.|
+| 3a c4 69 56 87 f6 f2 42 af 7b c4 df 86 b9 3b a9 |:.iV...B.{....;.|
+| aa b5 0e 83 47 5c 8c b2 b2 86 4e dd b0 29 75 1e |....G\....N..)u.|
+| 23 19 57 cc b6 eb 29 a7 98 28 c5 47 66 3a ae 14 |#.W...)..(.Gf:..|
+| 99 25 f7 80 af e4 2b da 52 c4 90 e2 96 c9 dc ca |.%....+.R.......|
+| 27 d2 d1 b3 ab da 6d d5 e0 05 c2 84 fd 28 f7 fd |'.....m......(..|
+| 6b ba 12 9e a4 77 61 59 4d 1b 38 3d 5f 7e f7 80 |k....waYM.8=_~..|
+| 06 b6 07 3e fd 8e f2 39 32 68 18 11 f5 21 50 25 |...>...92h...!P%|
+| ae 6d 99 f3 d1 b3 20 f2 96 72 b0 c9 2e 40 7d a1 |.m.... ..r...@}.|
+| 5c 48 6b 77 af dd a3 de 9a 47 e2 32 06 d3 2b 8f |\Hkw.....G.2..+.|
+| 46 56 54 72 c6 90 b9 80 8c 49 bd 69 09 b0 b0 00 |FVTr.....I.i....|
+| 78 e7 73 a8 4c 32 81 9c 26 e7 5d 99 3c ec e5 0e |x.s.L2..&.].<...|
+| fd 64 dd f6 cf eb 98 be 80 a2 1d 5d 2e f4 95 0c |.d.........]....|
+| d3 96 46 80 38 84 04 5c 81 3d 17 74 b2 52 1f ba |..F.8..\.=.t.R..|
+| 66 65 98 b5 3e 61 9b da d8 cf d5 8b 23 c2 60 54 |fe..>a......#.`T|
+| c7 94 85 9d be 5f 2b 80 f4 48 f0 2c 84 9c 45 2b |....._+..H.,..E+|
+| 0b 9e fb 77 26 c8 24 b6 38 a4 8a 3d bf c9 d7 be |...w&.$.8..=....|
+| 5d 1d 6a e4 b3 05 a7 e7 86 3d 22 66 08 70 ea 16 |].j......="f.p..|
+| a1 08 5f c5 ea cc 41 09 67 19 06 2a c1 9c 71 81 |.._...A.g..*..q.|
+| e1 bd 29 46 17 35 67 d0 8f db d7 e2 19 1f c0 c7 |..)F.5g.........|
+| f3 b8 87 35 fc b9 ba ca cd 45 ca ea 3f 64 d0 b7 |...5.....E..?d..|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 21 08 a6 8c |nl'</script>!...|
+| b7 56 91 46 13 22 9f c2 b2 6a a1 18 ce 83 77 64 |.V.F."...j....wd|
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4491 found 0x345e560
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345e560
+
+dissect_ssl enter frame #535 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 6a 9d 0f bb 14 3c 9a 4e 79 c7 33 ef 56 c0 b2 0a |j....<.Ny.3.V...|
+| 5b 0a 49 60 fb 82 |[.I`.. |
+Plaintext[22]:
+| 01 00 6c b9 ab 67 e9 02 fc 20 ec 0f 35 eb 73 69 |..l..g... ..5.si|
+| 97 b5 b8 06 6d 80 |....m. |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #537 (first time)
+ conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 29 7d fd 9c a5 d8 0c 1d 31 c6 70 09 23 52 31 f7 |)}......1.p.#R1.|
+| b2 ba b4 58 06 64 |...X.d |
+Plaintext[22]:
+| 01 00 98 b3 42 9f 69 93 62 1e bf d0 db e4 fd 13 |....B.i.b.......|
+| 93 94 98 97 23 69 |....#i |
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #542 (first time)
+ssl_session_init: initializing ptr 0x7f265a97fc00 size 688
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 34064 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4492
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #544 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 1243
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1157
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 345
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 331, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234
+ record: offset = 1234, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243
+
+dissect_ssl enter frame #546 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52...
+looking for RSA pre-master41040bb3ea7211d51feb313d489bc77f34c1e4bae58e8033...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 8a b9 79 4e 2c c9 9f bb 0f 31 33 81 b4 1c d7 8a |..yN,....13.....|
+| 4e 89 f9 7e ea 97 b2 66 c7 a2 4e 52 84 2d a1 97 |N..~...f..NR.-..|
+| c6 0c 11 a0 38 9c 3b 5e 9a 1a 62 3d 38 5f 20 7a |....8.;^..b=8_ z|
+| 18 bb c1 7c 06 71 7e 24 f4 8d 61 a1 74 0f 0f e0 |...|.q~$..a.t...|
+| bc f8 23 3d 39 9a f3 c0 7a 45 f2 66 3d 7c dc 07 |..#=9...zE.f=|..|
+| df 0d 91 e9 b6 88 47 b9 18 e7 2a 90 b9 11 c9 00 |......G...*.....|
+| 1a b0 9f a0 65 98 99 bd |....e... |
+Client MAC key[20]:
+| 8a b9 79 4e 2c c9 9f bb 0f 31 33 81 b4 1c d7 8a |..yN,....13.....|
+| 4e 89 f9 7e |N..~ |
+Server MAC key[20]:
+| ea 97 b2 66 c7 a2 4e 52 84 2d a1 97 c6 0c 11 a0 |...f..NR.-......|
+| 38 9c 3b 5e |8.;^ |
+Client Write key[24]:
+| 9a 1a 62 3d 38 5f 20 7a 18 bb c1 7c 06 71 7e 24 |..b=8_ z...|.q~$|
+| f4 8d 61 a1 74 0f 0f e0 |..a.t... |
+Server Write key[24]:
+| bc f8 23 3d 39 9a f3 c0 7a 45 f2 66 3d 7c dc 07 |..#=9...zE.f=|..|
+| df 0d 91 e9 b6 88 47 b9 |......G. |
+Client Write IV[8]:
+| 18 e7 2a 90 b9 11 c9 00 |..*..... |
+Server Write IV[8]:
+| 1a b0 9f a0 65 98 99 bd |....e... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| b4 8f 85 45 d9 42 62 cb 1f 6c 5f 92 17 70 61 06 |...E.Bb..l_..pa.|
+| 3b 27 da 4c c9 a6 c1 63 7e b4 dd 4a c9 4c a8 ac |;'.L...c~..J.L..|
+ssl_save_session stored master secret[48]:
+| 2e 71 b5 a0 62 f0 f5 77 9d 07 ca 0f a3 8c 43 70 |.q..b..w......Cp|
+| c2 56 66 8d af d1 d2 ab 15 2e d5 07 24 34 04 03 |.Vf.........$4..|
+| 46 e4 6f 2c aa 6f 4e 2a 8b e9 b3 ff f3 43 77 f2 |F.o,.oN*.....Cw.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| eb 6a 66 e6 ca a7 1c c1 1c 34 ff d6 18 57 ea bf |.jf......4...W..|
+| 56 6a c2 6e 4b 02 89 7a 12 27 2f 91 a9 68 b4 ad |Vj.nK..z.'/..h..|
+| 43 58 87 02 88 42 05 1f 1c 45 a2 e8 7b 41 fc 91 |CX...B...E..{A..|
+| 0f 98 a9 d1 7c 45 d0 40 a2 8e ef d2 fb 84 a5 19 |....|E.@........|
+Plaintext[64]:
+| 14 00 00 24 a5 2a 6a 39 dc 3b d3 78 2d 32 9c 3e |...$.*j9.;.x-2.>|
+| e4 6e c7 50 5c b3 24 a8 eb 0b f5 d3 31 a8 7e 35 |.n.P\.$.....1.~5|
+| 4b 93 d5 41 5c 9b 4c f9 89 e9 df e4 95 54 f8 c0 |K..A\.L......T..|
+| aa 9d d2 da 01 79 62 31 7d 58 78 27 00 00 00 03 |.....yb1}Xx'....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #547 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 25 95 47 ee 60 76 93 82 37 93 8c b9 7f 7a 2f 96 |%.G.`v..7....z/.|
+| 42 72 f1 ca 25 dc 33 e8 ce 60 dd 63 71 59 33 0e |Br..%.3..`.cqY3.|
+| 35 82 59 73 47 b2 15 27 84 06 0a d1 36 2e 2e 13 |5.YsG..'....6...|
+| 64 e5 cc cd ba 27 44 d3 d2 f5 70 6d 88 85 6e 97 |d....'D...pm..n.|
+Plaintext[64]:
+| 14 00 00 24 47 8e 92 d4 d4 e4 5d 47 22 17 09 c7 |...$G.....]G"...|
+| 09 79 0b 49 c1 a8 e3 c3 84 10 b3 e2 c1 38 2e f1 |.y.I.........8..|
+| fe 9f af a8 00 34 72 f7 9b 2d 57 3c 4e db 5b 47 |.....4r..-W<N.[G|
+| ba 81 2a 7d f1 37 da b7 9e fa fe 6d 00 00 00 03 |..*}.7.....m....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #548 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| 62 1e 03 d2 d6 a9 94 d3 4a 9b d4 c3 33 f7 e5 f8 |b.......J...3...|
+| 6c 80 72 85 03 95 9c 95 |l.r..... |
+Plaintext[24]:
+| 44 a3 86 10 bd 4c c0 0a 3f 9f 56 2a 4a f6 1e 82 |D....L..?.V*J...|
+| 61 e3 74 5f 00 00 00 03 |a.t_.... |
+ssl_decrypt_record found padding 3 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 34064 found (nil)
+association_find: TCP port 4492 found 0x345e5f0
+ record: offset = 29, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| db 8f e6 18 8b c6 09 07 4c c2 2a 65 82 00 9b 66 |........L.*e...f|
+| 25 1d b4 ae 45 fe 1d 9b 33 4f e8 df 79 6c 7f d6 |%...E...3O..yl..|
+| b3 0a 67 70 e6 3c b4 ee a5 f2 ed 28 fa 11 8b 68 |..gp.<.....(...h|
+| 02 cf 80 71 63 26 0e 28 6f 48 fa 51 dc 70 aa ea |...qc&.(oH.Q.p..|
+| d4 4f 4d 2e 72 68 c1 d3 9d af d6 31 a2 b7 28 7d |.OM.rh.....1..(}|
+| 89 da 18 ea 2d 5e f7 bf db ba 50 a8 fe d0 69 50 |....-^....P...iP|
+| b5 1f 7d 20 2b 6c f7 77 |..} +l.w |
+Plaintext[104]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 |des-cbc3-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 39 32 0d 0a 0d 0a 17 09 0c 3e |.nl:4492.......>|
+| dd b6 fa c4 ae 49 ed 23 98 29 1b 07 25 af f5 2f |.....I.#.)..%../|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 96
+checking mac (len 76, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 76, seq = 0, nxtseq = 76
+association_find: TCP port 34064 found (nil)
+association_find: TCP port 4492 found 0x345e5f0
+dissect_ssl3_record decrypted len 76
+decrypted app data fragment[76]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 |des-cbc3-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 39 32 0d 0a 0d 0a |.nl:4492.... |
+dissect_ssl3_record found association 0x345e5f0
+
+dissect_ssl enter frame #549 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 381
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 376, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 376
+Ciphertext[376]:
+| d8 64 ad eb b2 69 48 c8 c2 c0 b0 f9 45 7c 88 27 |.d...iH.....E|.'|
+| 56 a4 ff c4 47 7b 5d 1f d1 1b 20 71 f6 42 5c d5 |V...G{]... q.B\.|
+| 7f 25 d2 f4 49 8f 9a 8c 19 8b 4a 0a cf 14 c9 a1 |.%..I.....J.....|
+| 38 7d f0 16 58 95 5d fa 2a fb 14 2c 12 43 3c a5 |8}..X.].*..,.C<.|
+| a5 28 2f 42 68 c7 56 9a 9e f5 63 8b d7 80 98 a2 |.(/Bh.V...c.....|
+| 5b 85 1a 1c ed 86 0b 4f 4a 2a f1 18 c5 b4 e0 f9 |[......OJ*......|
+| 30 bf 98 f3 df 16 52 36 ff b6 36 f7 f2 93 03 d5 |0.....R6..6.....|
+| f7 48 7c 24 52 54 c3 c2 db 3b 38 b3 50 d9 a9 56 |.H|$RT...;8.P..V|
+| ea 6e 89 16 2f 82 00 8a aa 48 42 e2 17 10 35 1c |.n../....HB...5.|
+| 35 96 9f 4e e5 42 25 dc 1a f5 e6 0e c9 2c 93 57 |5..N.B%......,.W|
+| f5 38 76 b1 91 2b 66 77 b5 0e eb 2c f4 cc 86 89 |.8v..+fw...,....|
+| 23 58 fb 0e 34 84 d5 07 74 89 29 23 70 be 2c 63 |#X..4...t.)#p.,c|
+| 13 b0 e3 66 07 eb 24 9b b3 5b de ad 3a 9f 3f 28 |...f..$..[..:.?(|
+| 19 ca 7b e3 c1 69 28 2a d1 1f f7 ae 00 59 e9 e0 |..{..i(*.....Y..|
+| fb d2 5e f8 9a f3 4b b2 97 d2 10 ff 63 88 71 16 |..^...K.....c.q.|
+| fd d0 10 bb 34 fc b3 34 88 35 70 cf 28 1e 0b b7 |....4..4.5p.(...|
+| af 11 6f df 39 1e 15 1c 5f 48 4c ac 65 e8 4e 96 |..o.9..._HL.e.N.|
+| be ef 7c ad 6e e9 64 75 75 86 cf 62 88 58 4e ac |..|.n.duu..b.XN.|
+| f6 39 99 07 eb 98 7f e3 1b 6b c1 8a a1 f0 c9 c5 |.9.......k......|
+| fc 8c 49 ea c5 18 ef f2 21 cd 6c de 68 70 d2 6f |..I.....!.l.hp.o|
+| 8d 93 6e 2c 17 c1 18 af a6 5c c1 15 e8 77 09 a6 |..n,.....\...w..|
+| 49 1c 36 44 cd 60 30 4c fe 44 e0 dc f7 90 0a bb |I.6D.`0L.D......|
+| bc 0f ed a2 10 1c d0 22 47 46 d6 3c 6a e1 58 d1 |......."GF.<j.X.|
+| 17 e9 c1 d7 9a 58 ef a7 |.....X.. |
+Plaintext[376]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 32 20 2d 20 45 43 44 48 45 |xC0,0x12 - ECDHE|
+| 2d 52 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 |-RSA-DES-CBC3-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 53 e6 bc e5 |nl'</script>S...|
+| 65 56 b7 ef af 83 3b 89 81 26 36 be 00 1d 13 1f |eV....;..&6.....|
+| 00 00 00 00 00 00 00 07 |........ |
+ssl_decrypt_record found padding 7 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4492 found 0x345e5f0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 32 20 2d 20 45 43 44 48 45 |xC0,0x12 - ECDHE|
+| 2d 52 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 |-RSA-DES-CBC3-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345e5f0
+
+dissect_ssl enter frame #550 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| ce 23 c8 00 45 4c eb cc 39 ef e7 00 aa a8 d9 ad |.#..EL..9.......|
+| 59 f7 ea 7e 57 22 ed db |Y..~W".. |
+Plaintext[24]:
+| 01 00 4a c5 44 46 a6 02 e3 dc 2f fe ea b9 07 0e |..J.DF..../.....|
+| 63 21 b3 74 e4 4b 00 01 |c!.t.K.. |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #552 (first time)
+ conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00
+ record: offset = 0, reported_length_remaining = 29
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 24, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 24
+Ciphertext[24]:
+| ec 38 31 74 8d 16 75 73 30 24 d4 b0 48 f4 72 14 |.81t..us0$..H.r.|
+| 3a 17 9d c2 17 90 ec 91 |:....... |
+Plaintext[24]:
+| 01 00 7f 00 0d d1 1a 5f 87 9f 00 5c 31 73 56 87 |......._...\1sV.|
+| 2b 0e 57 a2 e4 a1 00 01 |+.W..... |
+ssl_decrypt_record found padding 1 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #557 (first time)
+ssl_session_init: initializing ptr 0x7f265a9823a0 size 688
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 54766 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4493
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #559 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 1243
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1157
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 345
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 331, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234
+ record: offset = 1234, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243
+
+dissect_ssl enter frame #561 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a...
+looking for RSA pre-master4104317f74638211f2f6218b77f33284b44813aa22364dfe...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718626c958f65c36cdc2f6517db0f369951c5f8c41fbf45248538b6d050 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497185c750857e25775f2a635b1d3706ead2cc8bc625ed41c1063c7dd7965 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a4285ba3c4e6be2f7 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+key expansion[104]:
+| 31 5f eb c8 e8 58 05 67 07 2b a6 93 cc 71 a3 4e |1_...X.g.+...q.N|
+| 9c 99 f3 c7 8e b7 be 85 6e 4f e3 c3 6e c0 66 3c |........nO..n.f<|
+| 8b 59 44 5b e3 ba 65 7a fc f4 03 63 96 36 a2 fb |.YD[..ez...c.6..|
+| bc 23 73 39 92 e9 1d f2 a3 4d b0 85 20 91 52 51 |.#s9.....M.. .RQ|
+| 00 2c 37 f3 c1 11 01 e4 1b 68 f1 a8 9f a1 8b 98 |.,7......h......|
+| 8a dc 09 68 2d d4 d4 ef 16 ff 2e ac f2 26 05 f5 |...h-........&..|
+| df 55 17 98 89 51 ea 4e |.U...Q.N |
+Client MAC key[20]:
+| 31 5f eb c8 e8 58 05 67 07 2b a6 93 cc 71 a3 4e |1_...X.g.+...q.N|
+| 9c 99 f3 c7 |.... |
+Server MAC key[20]:
+| 8e b7 be 85 6e 4f e3 c3 6e c0 66 3c 8b 59 44 5b |....nO..n.f<.YD[|
+| e3 ba 65 7a |..ez |
+Client Write key[16]:
+| fc f4 03 63 96 36 a2 fb bc 23 73 39 92 e9 1d f2 |...c.6...#s9....|
+Server Write key[16]:
+| a3 4d b0 85 20 91 52 51 00 2c 37 f3 c1 11 01 e4 |.M.. .RQ.,7.....|
+Client Write IV[16]:
+| 1b 68 f1 a8 9f a1 8b 98 8a dc 09 68 2d d4 d4 ef |.h.........h-...|
+Server Write IV[16]:
+| 16 ff 2e ac f2 26 05 f5 df 55 17 98 89 51 ea 4e |.....&...U...Q.N|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| a3 e1 fa 8c 1b af e2 ff 18 ef e7 04 dc 10 02 c5 |................|
+| 58 cb 9e 44 c1 a0 b0 7e 95 7c 12 aa c8 ba 6d 94 |X..D...~.|....m.|
+ssl_save_session stored master secret[48]:
+| 56 85 f5 3d 47 e7 c8 d5 47 ae 4c 8d e8 9e 0c f1 |V..=G...G.L.....|
+| 11 b2 17 9f 69 1e d2 89 c4 6b aa f9 9a f6 61 37 |....i....k....a7|
+| 75 af 03 97 7e ed ff 56 d5 83 d1 75 c5 ef aa c6 |u...~..V...u....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 0f 89 4b e2 30 a0 35 ba fa 99 96 47 d6 d9 8b a1 |..K.0.5....G....|
+| 9a 86 78 0e f4 ca 64 c7 9e dd 4f 9a 13 82 26 fe |..x...d...O...&.|
+| b5 01 fb 22 ad 36 79 cc cb 01 d2 0d 0a a4 ae bd |...".6y.........|
+| 04 2f 2d 18 8e f8 29 1a 08 0b 54 2b ce fb b3 5a |./-...)...T+...Z|
+Plaintext[64]:
+| 14 00 00 24 b6 79 39 92 b2 93 9b d3 15 9c e2 06 |...$.y9.........|
+| e0 33 92 14 9d 3d 3c ec c3 54 f6 f2 c2 ed 08 6c |.3...=<..T.....l|
+| 68 8b cf a2 70 26 d1 53 9d 12 3a d3 6e a4 5a da |h...p&.S..:.n.Z.|
+| 0f 11 2d d6 4c 19 cc ec 2d ff 84 f2 00 00 00 03 |..-.L...-.......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #562 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 2e 3c 24 d0 23 b0 ad 65 4f 20 82 7e 24 23 b7 df |.<$.#..eO .~$#..|
+| 66 21 c4 04 91 c0 e0 5c 9f 0e 90 d7 c3 f7 97 5a |f!.....\.......Z|
+| 85 22 36 74 c7 9c c6 99 43 76 2c 35 22 56 d2 6a |."6t....Cv,5"V.j|
+| 13 f6 a4 43 d3 36 a8 b6 54 e1 bc ec 80 3e d9 e2 |...C.6..T....>..|
+Plaintext[64]:
+| 14 00 00 24 48 b3 17 09 1f 85 b9 14 b1 79 2b b7 |...$H........y+.|
+| a8 fe fd 19 65 72 cf 56 bc 35 76 4e 35 83 48 bf |....er.V.5vN5.H.|
+| f4 22 89 89 f1 d0 bc 1b 82 2f 20 e8 d2 af 52 01 |."......./ ...R.|
+| 75 9e a4 3d 9c f5 c4 2d cb 03 98 71 00 00 00 03 |u..=...-...q....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #563 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| a6 e8 84 6c f0 4a cc 4e a5 f0 6a ff ec a7 61 74 |...l.J.N..j...at|
+| 7c 16 71 ec 54 f8 18 f4 ee 2b 4e 7b a0 ef 8e 08 ||.q.T....+N{....|
+Plaintext[32]:
+| 56 fb 3d 9f b4 e6 2b 2f 2e 50 05 67 5f 12 f6 70 |V.=...+/.P.g_..p|
+| 56 8c e7 4a 00 00 00 00 00 00 00 00 00 00 00 0b |V..J............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 54766 found (nil)
+association_find: TCP port 4493 found 0x345e680
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 7d 0e 2a 05 00 e5 eb ce e4 82 fc bc 20 3b c7 bd |}.*......... ;..|
+| e9 34 86 84 78 bd 6d 48 74 d6 a0 85 ff 91 0d aa |.4..x.mHt.......|
+| bd 2e f6 df a9 bc 50 3d df ad 45 de 56 56 3e df |......P=..E.VV>.|
+| 92 cf ef 4c 79 84 0e df d3 d1 b9 3f 87 64 64 66 |...Ly......?.ddf|
+| bd 8a ab 9a 06 7e 78 6d d0 88 c7 79 27 ad b0 d8 |.....~xm...y'...|
+| 6c ef 92 92 83 ef e6 0b 2f 1b 2c fc 67 de 4d 2e |l......./.,.g.M.|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 33 0d 0a 0d 0a 88 c1 81 3d 11 57 |l:4493.......=.W|
+| 2d 94 33 8f 88 ea e8 a0 cd bd a2 06 07 4b 00 01 |-.3..........K..|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 74, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74
+association_find: TCP port 54766 found (nil)
+association_find: TCP port 4493 found 0x345e680
+dissect_ssl3_record decrypted len 74
+decrypted app data fragment[74]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 33 0d 0a 0d 0a |l:4493.... |
+dissect_ssl3_record found association 0x345e680
+
+dissect_ssl enter frame #564 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 8e 9a 50 d4 a6 3d 4e 67 8a 97 f9 c4 fb 75 c1 93 |..P..=Ng.....u..|
+| b0 5d d9 4f 5f 7c 8f ca 4b 70 73 09 64 86 6a 9f |.].O_|..Kps.d.j.|
+| 4a 36 17 2b 5a 79 ac 13 95 e6 bc 03 5d 21 68 cd |J6.+Zy......]!h.|
+| 8a eb c8 0d 1d 85 05 0a b2 30 8f 94 27 0f 81 f9 |.........0..'...|
+| 2d 37 61 a5 97 6e 44 37 d3 2d b2 b7 3e 21 ab 5a |-7a..nD7.-..>!.Z|
+| d2 c3 98 fb 61 d2 9a 8d 38 10 8c 43 e5 11 13 55 |....a...8..C...U|
+| 45 7c 09 cc 35 35 56 5a bf b0 4c f9 af 9b 8f bf |E|..55VZ..L.....|
+| 11 21 e0 5a 8f aa 5b d9 c7 2a 44 b5 78 fc 2c b4 |.!.Z..[..*D.x.,.|
+| 52 12 24 28 7b a1 b6 f0 d3 12 f9 0b 68 66 e0 d8 |R.$({.......hf..|
+| bc 71 9d 07 ec 7e 2f fe 09 97 3f 83 29 a1 5b dd |.q...~/...?.).[.|
+| b6 6e 82 2a 7a 0a 47 26 51 e2 4b 92 b9 50 92 09 |.n.*z.G&Q.K..P..|
+| 01 49 32 bb 63 3f 4b 40 61 0b 8c 04 a5 b7 15 c0 |.I2.c?K@a.......|
+| b8 84 99 b4 ea b4 a4 9f 4d a0 16 0e 0f 30 6a 9e |........M....0j.|
+| 30 67 a3 0e 95 ab 3e de 59 9e c5 cc 95 54 7c 90 |0g....>.Y....T|.|
+| ed cb 65 7a 6b f6 50 99 2a 91 89 bb 3d 81 1e 2d |..ezk.P.*...=..-|
+| 46 3e c4 0c 5d d2 b0 6e 98 ed 19 f2 6c 29 e5 ec |F>..]..n....l)..|
+| fe e6 e8 94 fb 2c 9e 2b 18 6b 62 cd e7 ab 73 63 |.....,.+.kb...sc|
+| 0d e6 d6 60 4a 8a 52 4c 50 75 69 ba 86 f9 f1 c6 |...`J.RLPui.....|
+| b2 9c d1 6a 70 4a 34 dc 2a 59 0b 46 37 66 1f 4b |...jpJ4.*Y.F7f.K|
+| 1e e1 6c a5 60 6d dc 1f 76 36 d8 e2 bc 54 48 6c |..l.`m..v6...THl|
+| c2 ec 67 7f db 06 ff 0e a9 c1 ad 97 ec 8f 27 af |..g...........'.|
+| 6a 5b 85 44 8d 45 98 fc ff 0f 54 7f dd c5 ce 29 |j[.D.E....T....)|
+| 3f 38 6f 06 79 f3 e9 c6 a1 ab 98 cb 40 0c 1a af |?8o.y.......@...|
+| 61 8f f4 9d 8c d9 e6 31 c7 50 22 4a 31 5a 5f ed |a......1.P"J1Z_.|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9d 21 9a ee |nl'</script>.!..|
+| dc e4 78 60 4b 68 d8 ea ef bf a0 20 e1 e6 e5 72 |..x`Kh..... ...r|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4493 found 0x345e680
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345e680
+
+dissect_ssl enter frame #565 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| b8 2d 57 4c f4 bd fc 21 b9 9a 22 6b 0e 3a 96 53 |.-WL...!.."k.:.S|
+| 00 93 c4 da 55 fe 6e cb a6 a1 ff 74 62 89 0b db |....U.n....tb...|
+Plaintext[32]:
+| 01 00 44 6d 7e f0 30 e7 bc 66 49 11 41 42 95 5f |..Dm~.0..fI.AB._|
+| 89 6b ff f2 29 06 00 00 00 00 00 00 00 00 00 09 |.k..)...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #567 (first time)
+ conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| c5 e4 18 73 f7 0f b9 73 1b f5 bd 90 e7 13 88 1f |...s...s........|
+| 91 a8 48 76 18 1c 08 5e cd c8 d9 c1 5d 9a b2 53 |..Hv...^....]..S|
+Plaintext[32]:
+| 01 00 a3 95 72 70 81 3e c0 b0 2b d8 ac 58 0b 84 |....rp.>..+..X..|
+| 4b 4b e8 5a 95 6c 00 00 00 00 00 00 00 00 00 09 |KK.Z.l..........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #572 (first time)
+ssl_session_init: initializing ptr 0x7f265a984b00 size 688
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 148, ssl state 0x00
+association_find: TCP port 40985 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4494
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #574 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 1243
+dissect_ssl3_record found version 0x0300 -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 81, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x17
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 86, reported_length_remaining = 1157
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 345
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 331, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234
+ record: offset = 1234, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x17
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243
+
+dissect_ssl enter frame #576 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x17
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt
+looking for CLIENT_RANDOM 52349718c617ad5c130abc00e675f2c6cff25c02b23ca290...
+looking for RSA pre-master4104959a3f6259576abc33b9c79fb43bf5c6c8caef546651...
+ checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718626c958f65c36cdc2f6517db0f369951c5f8c41fbf45248538b6d050 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 523497185c750857e25775f2a635b1d3706ead2cc8bc625ed41c1063c7dd7965 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a4285ba3c4e6be2f7 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718e6b6d3a218ad1e415c3fa505b4c3e4d7aba48c5fb96df36fdff37e6c DE5744B132A5B614761C9354987C146F82889F6155CE373832E19B74A1C67226353FE8D33D83B7DE4D73E947C6434780
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 52349718c617ad5c130abc00e675f2c6cff25c02b23ca290596ca0ac06802dcb DE5744B132A5B614761C9354987C146F82889F6155CE373832E19B74A1C67226353FE8D33D83B7DE4D73E947C6434780
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+ssl3_prf: sha1_hash(1)
+ssl3_prf: md5_hash(1) datalen 48
+ssl3_prf: sha1_hash(2)
+ssl3_prf: md5_hash(2) datalen 48
+ssl3_prf: sha1_hash(3)
+ssl3_prf: md5_hash(3) datalen 48
+ssl3_prf: sha1_hash(4)
+ssl3_prf: md5_hash(4) datalen 48
+ssl3_prf: sha1_hash(5)
+ssl3_prf: md5_hash(5) datalen 48
+ssl3_prf: sha1_hash(6)
+ssl3_prf: md5_hash(6) datalen 48
+ssl3_prf: sha1_hash(7)
+ssl3_prf: md5_hash(7) datalen 48
+ssl3_prf: sha1_hash(8)
+ssl3_prf: md5_hash(8) datalen 48
+ssl3_prf: sha1_hash(9)
+ssl3_prf: md5_hash(9) datalen 48
+key expansion[136]:
+| 12 67 de c9 6c 4f 0c 9d 91 8d 90 36 23 ae 8f 0b |.g..lO.....6#...|
+| 11 bd fd 99 52 f2 81 71 cf cd d7 39 7b f5 89 39 |....R..q...9{..9|
+| 15 15 e8 99 4a be a1 f9 b7 cb 0f 74 3d fa bd e5 |....J......t=...|
+| 08 23 02 a4 98 92 46 85 6b 8e 7f a5 5a e9 11 d6 |.#....F.k...Z...|
+| 84 ab a0 a7 de 5b 40 23 c6 44 49 f4 e8 b6 10 83 |.....[@#.DI.....|
+| ad dd 69 27 9f 53 aa b6 a5 ad b7 29 70 8b 2e 0d |..i'.S.....)p...|
+| 89 d1 b6 09 be 8e 86 cd 0c 98 eb 32 be aa 12 bf |...........2....|
+| 15 83 b0 68 35 58 d4 ad 3c 4a cd d6 a0 9d fe c1 |...h5X..<J......|
+| c0 02 b0 94 bb ab 3c 97 |......<. |
+Client MAC key[20]:
+| 12 67 de c9 6c 4f 0c 9d 91 8d 90 36 23 ae 8f 0b |.g..lO.....6#...|
+| 11 bd fd 99 |.... |
+Server MAC key[20]:
+| 52 f2 81 71 cf cd d7 39 7b f5 89 39 15 15 e8 99 |R..q...9{..9....|
+| 4a be a1 f9 |J... |
+Client Write key[32]:
+| b7 cb 0f 74 3d fa bd e5 08 23 02 a4 98 92 46 85 |...t=....#....F.|
+| 6b 8e 7f a5 5a e9 11 d6 84 ab a0 a7 de 5b 40 23 |k...Z........[@#|
+Server Write key[32]:
+| c6 44 49 f4 e8 b6 10 83 ad dd 69 27 9f 53 aa b6 |.DI.......i'.S..|
+| a5 ad b7 29 70 8b 2e 0d 89 d1 b6 09 be 8e 86 cd |...)p...........|
+Client Write IV[16]:
+| 0c 98 eb 32 be aa 12 bf 15 83 b0 68 35 58 d4 ad |...2.......h5X..|
+Server Write IV[16]:
+| 3c 4a cd d6 a0 9d fe c1 c0 02 b0 94 bb ab 3c 97 |<J............<.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[32]:
+| 04 56 7e 8f 3e 2f ef 04 5e e2 60 db aa 30 d8 e1 |.V~.>/..^.`..0..|
+| f9 c8 d0 77 9c 12 9d 20 6a ef a9 5f 3c bd ae bf |...w... j.._<...|
+ssl_save_session stored master secret[48]:
+| de 57 44 b1 32 a5 b6 14 76 1c 93 54 98 7c 14 6f |.WD.2...v..T.|.o|
+| 82 88 9f 61 55 ce 37 38 32 e1 9b 74 a1 c6 72 26 |...aU.782..t..r&|
+| 35 3f e8 d3 3d 83 b7 de 4d 73 e9 47 c6 43 47 80 |5?..=...Ms.G.CG.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 21 4e 06 16 36 4d 8c 04 aa d0 da 25 63 24 7a 52 |!N..6M.....%c$zR|
+| 0c 6c 0f 8c 02 0e ae 6a ff 4b 97 d2 21 d0 e5 00 |.l.....j.K..!...|
+| dd 0b 66 eb bc 77 ef 4c 81 7a 59 74 98 91 a6 20 |..f..w.L.zYt... |
+| 2d 0b 1c ee 70 1a 45 9b c4 53 7a a0 d7 05 9f 91 |-...p.E..Sz.....|
+Plaintext[64]:
+| 14 00 00 24 dd 95 da e1 38 00 cc 84 2c d1 eb 23 |...$....8...,..#|
+| 6e 4b b4 08 f0 ff 61 5b 0d a5 54 09 4e 93 6e 97 |nK....a[..T.N.n.|
+| 31 fc bb 52 01 0a 5e 81 9f 7b 42 e4 8f 3e 13 5d |1..R..^..{B..>.]|
+| 9b 98 cf 23 a0 1e 99 49 af f3 66 39 00 00 00 03 |...#...I..f9....|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #577 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 6, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 08 aa df 27 28 66 a6 23 94 dc 50 27 81 d6 fb 68 |...'(f.#..P'...h|
+| 0c df 86 87 c7 74 09 76 ff de b5 e7 bd 4e 6d 88 |.....t.v.....Nm.|
+| ba 99 a7 b2 65 20 31 e4 00 6b e6 11 fb 64 31 6f |....e 1..k...d1o|
+| 33 42 86 b0 c8 2f 86 b1 21 9b 8c bf 6d e3 c5 c8 |3B.../..!...m...|
+Plaintext[64]:
+| 14 00 00 24 ea bd 1a e8 eb 17 c6 11 0c 82 cd 46 |...$...........F|
+| 81 7c 15 a3 e3 6e fe 67 71 79 e9 04 fa 02 c9 37 |.|...n.gqy.....7|
+| 8c 0d 73 5a ec a2 fc 64 93 18 48 f1 06 41 c4 3d |..sZ...d..H..A.=|
+| d9 06 96 54 3a 36 75 cb ec 44 c6 d7 00 00 00 03 |...T:6u..D......|
+ssl_decrypt_record found padding 3 final len 60
+checking mac (len 40, version 300, ct 22 seq 0)
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #578 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 138
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 4c 61 d2 cc 9f cb 0d 2c 7a 9a d4 00 cc f8 c7 fb |La.....,z.......|
+| aa e9 4f d0 1e 3f 5d bd d8 9f 4d 28 86 92 32 a1 |..O..?]...M(..2.|
+Plaintext[32]:
+| 30 d5 98 2d fd 36 2a 13 9e 0c b6 28 99 4f 81 87 |0..-.6*....(.O..|
+| 04 44 e7 f5 00 00 00 00 00 00 00 00 00 00 00 0b |.D..............|
+ssl_decrypt_record found padding 11 final len 20
+checking mac (len 0, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0
+association_find: TCP port 40985 found (nil)
+association_find: TCP port 4494 found 0x345e710
+ record: offset = 37, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| c7 53 d9 7d cb ae 07 fe 3f e5 e5 43 9c 43 cb c9 |.S.}....?..C.C..|
+| ce f6 3a 65 7e 69 6e 75 00 5d 87 c6 db e5 29 91 |..:e~inu.]....).|
+| a4 17 a0 bd 0e 40 0b 19 ee f0 8f 89 22 7b 63 2e |.....@......"{c.|
+| 7b db ee e5 16 5e 23 01 9f 94 77 f5 45 04 14 b4 |{....^#...w.E...|
+| d7 6c 06 3b a8 54 cb 02 e4 54 99 21 d0 f3 68 3f |.l.;.T...T.!..h?|
+| 79 d1 3d aa 2b c6 be 58 34 d6 70 62 1f 90 1d e2 |y.=.+..X4.pb....|
+Plaintext[96]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 34 0d 0a 0d 0a 5e 07 34 4e cb 96 |l:4494....^.4N..|
+| ac b2 26 63 d6 d9 c9 1e 2e b6 2e 94 de ce 00 01 |..&c............|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 74, version 300, ct 23 seq 2)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74
+association_find: TCP port 40985 found (nil)
+association_find: TCP port 4494 found 0x345e710
+dissect_ssl3_record decrypted len 74
+decrypted app data fragment[74]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 34 0d 0a 0d 0a |l:4494.... |
+dissect_ssl3_record found association 0x345e710
+
+dissect_ssl enter frame #579 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 64 8b 54 62 5d b4 6e d3 d4 b4 c2 c7 59 0a 4d 35 |d.Tb].n.....Y.M5|
+| 6f 4a 08 8c 69 2d 4f c9 a1 50 f8 72 90 57 67 a0 |oJ..i-O..P.r.Wg.|
+| 9e 89 a8 e5 c3 b8 01 e3 ff 88 c8 db 82 af 0b 1e |................|
+| 87 1f 0d d2 fb 0d 78 71 59 d8 8d fd 56 c9 bd 0a |......xqY...V...|
+| c7 d0 c0 9e 85 17 e4 89 8d 27 6b e2 63 0a 14 e4 |.........'k.c...|
+| 49 3a 3a fd c0 f7 b6 e8 c5 2e 5d 44 2c f6 fe 74 |I::.......]D,..t|
+| b3 12 56 7d 7e f2 82 8b 30 45 de 4f 69 ee b7 7d |..V}~...0E.Oi..}|
+| a8 27 14 ea 17 49 1e 12 bf 1d 10 ea c3 bb 01 95 |.'...I..........|
+| 6c 65 9c 46 a0 43 cb 89 25 23 9d a5 dd f2 c3 fb |le.F.C..%#......|
+| a9 50 24 6c 10 d1 04 ee a6 be 43 91 88 c2 ed ef |.P$l......C.....|
+| cc 1e 2d 4e 31 a5 fc 95 58 cf 0c c0 ee ff d6 b8 |..-N1...X.......|
+| 2d 86 22 f2 5d 63 3c ed 1e 4e 99 9d 30 f3 97 76 |-.".]c<..N..0..v|
+| f4 c5 4f d5 9f 87 b9 78 5d b3 a9 24 fc a2 0d 54 |..O....x]..$...T|
+| 1e d7 70 1f 4c c8 9c 84 ca f9 bf 47 01 70 5c 98 |..p.L......G.p\.|
+| 5f bb d8 c3 24 4b b9 a4 07 52 3f c9 d0 4b 64 aa |_...$K...R?..Kd.|
+| e3 6a 94 27 20 d8 9d 30 30 fa 52 51 b8 0a 9e a9 |.j.' ..00.RQ....|
+| 14 ad b7 5d 92 7c c9 32 40 ed ea 61 07 f5 a8 df |...].|.2@..a....|
+| a1 0b d0 c0 df ea 51 83 d5 56 bf f0 2f 27 47 8c |......Q..V../'G.|
+| b7 e9 59 a1 bb 1c ee 1d 7c ac 90 a2 73 56 08 3d |..Y.....|...sV.=|
+| 6f d6 19 6f 8d 8c d2 e2 48 b9 c2 16 05 84 60 ba |o..o....H.....`.|
+| 3a 25 c5 4a b9 18 59 d7 99 17 60 8f 57 45 85 96 |:%.J..Y...`.WE..|
+| 78 66 a4 51 de 2a 0c 06 35 55 8a 2d 89 de c3 5c |xf.Q.*..5U.-...\|
+| 3d 90 dc 0b 58 a7 83 94 0a 79 8a 9f 71 20 f6 7a |=...X....y..q .z|
+| 2d 68 d0 3f f4 e2 7d 12 b3 4c 30 ff 5d fb eb b8 |-h.?..}..L0.]...|
+Plaintext[384]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 6d 93 59 99 |nl'</script>m.Y.|
+| a9 f2 fb 28 4d 30 51 8d 1c ad 55 78 22 3d 0a 54 |...(M0Q...Ux"=.T|
+| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................|
+ssl_decrypt_record found padding 15 final len 368
+checking mac (len 348, version 300, ct 23 seq 1)
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4494 found 0x345e710
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x345e710
+
+dissect_ssl enter frame #580 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 16 14 1b 0c 3c 76 4b af 80 12 56 06 fe 91 6f d6 |....<vK...V...o.|
+| c9 7c f0 c9 a5 65 cb 95 1b 66 d0 39 88 d6 43 ac |.|...e...f.9..C.|
+Plaintext[32]:
+| 01 00 0b 14 0f 33 48 97 61 93 f0 d9 44 e2 08 83 |.....3H.a...D...|
+| 9d d0 28 f7 ea de 00 00 00 00 00 00 00 00 00 09 |..(.............|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 2)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #582 (first time)
+ conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 90 12 2a 41 be 29 56 06 bb 68 85 43 c5 a7 20 18 |..*A.)V..h.C.. .|
+| 9b c6 71 15 42 fe f7 54 26 93 65 ed fd 64 45 5d |..q.B..T&.e..dE]|
+Plaintext[32]:
+| 01 00 f8 21 b9 e0 99 c0 cb c2 72 14 8e 77 b0 70 |...!......r..w.p|
+| 12 5e e0 f9 30 fd 00 00 00 00 00 00 00 00 00 09 |.^..0...........|
+ssl_decrypt_record found padding 9 final len 22
+checking mac (len 2, version 300, ct 21 seq 3)
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #4 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 153
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153
+
+dissect_ssl enter frame #6 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 1245
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
+ record: offset = 86, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898
+ record: offset = 898, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236
+ record: offset = 1236, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245
+
+dissect_ssl enter frame #8 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 140
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73
+ record: offset = 73, reported_length_remaining = 67
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 79, reported_length_remaining = 61
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #128 (already visited)
+ conversation = 0x7f2686943a78, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #9 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 67
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 6, reported_length_remaining = 61
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40
+
+dissect_ssl enter frame #10 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 39639 found (nil)
+association_find: TCP port 4434 found 0x3451b20
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x3451b20
+
+dissect_ssl enter frame #11 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 4434 found 0x3451b20
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:|
+| 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x3451b20
+
+dissect_ssl enter frame #12 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+
+dissect_ssl enter frame #14 (already visited)
+ conversation = 0x7f2686942088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
diff --git a/ssl3/dump.pcapng b/ssl3/dump.pcapng
new file mode 100644
index 0000000..25c3dbc
--- /dev/null
+++ b/ssl3/dump.pcapng
Binary files differ
diff --git a/ssl3/not-ssl3-urls.txt b/ssl3/not-ssl3-urls.txt
new file mode 100644
index 0000000..10504da
--- /dev/null
+++ b/ssl3/not-ssl3-urls.txt
@@ -0,0 +1,44 @@
+https://exp-edh-dss-des-cbc-sha.local.al.lekensteyn.nl:4442
+https://exp-edh-rsa-des-cbc-sha.local.al.lekensteyn.nl:4445
+https://aes128-sha256.local.al.lekensteyn.nl:4454
+https://aes256-sha256.local.al.lekensteyn.nl:4455
+https://dhe-dss-aes128-sha256.local.al.lekensteyn.nl:4456
+https://dhe-rsa-aes128-sha256.local.al.lekensteyn.nl:4460
+https://dhe-dss-aes256-sha256.local.al.lekensteyn.nl:4461
+https://dhe-rsa-aes256-sha256.local.al.lekensteyn.nl:4462
+https://psk-rc4-sha.local.al.lekensteyn.nl:4466
+https://psk-3des-ede-cbc-sha.local.al.lekensteyn.nl:4467
+https://psk-aes128-cbc-sha.local.al.lekensteyn.nl:4468
+https://psk-aes256-cbc-sha.local.al.lekensteyn.nl:4469
+https://aes128-gcm-sha256.local.al.lekensteyn.nl:4473
+https://aes256-gcm-sha384.local.al.lekensteyn.nl:4474
+https://dhe-rsa-aes128-gcm-sha256.local.al.lekensteyn.nl:4475
+https://dhe-rsa-aes256-gcm-sha384.local.al.lekensteyn.nl:4476
+https://dhe-dss-aes128-gcm-sha256.local.al.lekensteyn.nl:4477
+https://dhe-dss-aes256-gcm-sha384.local.al.lekensteyn.nl:4478
+https://ecdh-rsa-rc4-sha.local.al.lekensteyn.nl:4487
+https://ecdh-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4488
+https://ecdh-rsa-aes128-sha.local.al.lekensteyn.nl:4489
+https://ecdh-rsa-aes256-sha.local.al.lekensteyn.nl:4490
+https://srp-rsa-3des-ede-cbc-sha.local.al.lekensteyn.nl:4495
+https://srp-dss-3des-ede-cbc-sha.local.al.lekensteyn.nl:4496
+https://srp-rsa-aes-128-cbc-sha.local.al.lekensteyn.nl:4497
+https://srp-dss-aes-128-cbc-sha.local.al.lekensteyn.nl:4498
+https://srp-rsa-aes-256-cbc-sha.local.al.lekensteyn.nl:4499
+https://srp-dss-aes-256-cbc-sha.local.al.lekensteyn.nl:4500
+https://ecdhe-ecdsa-aes128-sha256.local.al.lekensteyn.nl:4501
+https://ecdhe-ecdsa-aes256-sha384.local.al.lekensteyn.nl:4502
+https://ecdh-ecdsa-aes128-sha256.local.al.lekensteyn.nl:4503
+https://ecdh-ecdsa-aes256-sha384.local.al.lekensteyn.nl:4504
+https://ecdhe-rsa-aes128-sha256.local.al.lekensteyn.nl:4505
+https://ecdhe-rsa-aes256-sha384.local.al.lekensteyn.nl:4506
+https://ecdh-rsa-aes128-sha256.local.al.lekensteyn.nl:4507
+https://ecdh-rsa-aes256-sha384.local.al.lekensteyn.nl:4508
+https://ecdhe-ecdsa-aes128-gcm-sha256.local.al.lekensteyn.nl:4509
+https://ecdhe-ecdsa-aes256-gcm-sha384.local.al.lekensteyn.nl:4510
+https://ecdh-ecdsa-aes128-gcm-sha256.local.al.lekensteyn.nl:4511
+https://ecdh-ecdsa-aes256-gcm-sha384.local.al.lekensteyn.nl:4512
+https://ecdhe-rsa-aes128-gcm-sha256.local.al.lekensteyn.nl:4513
+https://ecdhe-rsa-aes256-gcm-sha384.local.al.lekensteyn.nl:4514
+https://ecdh-rsa-aes128-gcm-sha256.local.al.lekensteyn.nl:4515
+https://ecdh-rsa-aes256-gcm-sha384.local.al.lekensteyn.nl:4516
diff --git a/ssl3/premaster.txt b/ssl3/premaster.txt
new file mode 100644
index 0000000..150652f
--- /dev/null
+++ b/ssl3/premaster.txt
@@ -0,0 +1,78 @@
+CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E
+CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1
+CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2
+CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7
+CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E
+CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8
+CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866
+CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7
+CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF
+CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C
+CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA
+CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367
+CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC
+CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3
+CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D
+CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4
+CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480
+CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641
+CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205
+CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312
+CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC
+CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B
+CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555
+CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850
+CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF
+CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02
+CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3
+CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75
+CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3
+CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298
+CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A
+CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF
+CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1
+CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913
+CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C
+CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56
+CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+CLIENT_RANDOM 52349718626c958f65c36cdc2f6517db0f369951c5f8c41fbf45248538b6d050 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2
+CLIENT_RANDOM 523497185c750857e25775f2a635b1d3706ead2cc8bc625ed41c1063c7dd7965 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6
+CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a4285ba3c4e6be2f7 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6
+CLIENT_RANDOM 52349718e6b6d3a218ad1e415c3fa505b4c3e4d7aba48c5fb96df36fdff37e6c DE5744B132A5B614761C9354987C146F82889F6155CE373832E19B74A1C67226353FE8D33D83B7DE4D73E947C6434780
+CLIENT_RANDOM 52349718c617ad5c130abc00e675f2c6cff25c02b23ca290596ca0ac06802dcb DE5744B132A5B614761C9354987C146F82889F6155CE373832E19B74A1C67226353FE8D33D83B7DE4D73E947C6434780
diff --git a/ssl3/ssl3-urls.txt b/ssl3/ssl3-urls.txt
new file mode 100644
index 0000000..0e1702f
--- /dev/null
+++ b/ssl3/ssl3-urls.txt
@@ -0,0 +1,39 @@
+https://exp-rc4-md5.local.al.lekensteyn.nl:4434
+https://rc4-md5.local.al.lekensteyn.nl:4435
+https://rc4-sha.local.al.lekensteyn.nl:4436
+https://exp-rc2-cbc-md5.local.al.lekensteyn.nl:4437
+https://idea-cbc-sha.local.al.lekensteyn.nl:4438
+https://exp-des-cbc-sha.local.al.lekensteyn.nl:4439
+https://des-cbc-sha.local.al.lekensteyn.nl:4440
+https://des-cbc3-sha.local.al.lekensteyn.nl:4441
+https://edh-dss-des-cbc-sha.local.al.lekensteyn.nl:4443
+https://edh-dss-des-cbc3-sha.local.al.lekensteyn.nl:4444
+https://edh-rsa-des-cbc-sha.local.al.lekensteyn.nl:4446
+https://edh-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4447
+https://aes128-sha.local.al.lekensteyn.nl:4448
+https://dhe-dss-aes128-sha.local.al.lekensteyn.nl:4449
+https://dhe-rsa-aes128-sha.local.al.lekensteyn.nl:4450
+https://aes256-sha.local.al.lekensteyn.nl:4451
+https://dhe-dss-aes256-sha.local.al.lekensteyn.nl:4452
+https://dhe-rsa-aes256-sha.local.al.lekensteyn.nl:4453
+https://camellia128-sha.local.al.lekensteyn.nl:4457
+https://dhe-dss-camellia128-sha.local.al.lekensteyn.nl:4458
+https://dhe-rsa-camellia128-sha.local.al.lekensteyn.nl:4459
+https://camellia256-sha.local.al.lekensteyn.nl:4463
+https://dhe-dss-camellia256-sha.local.al.lekensteyn.nl:4464
+https://dhe-rsa-camellia256-sha.local.al.lekensteyn.nl:4465
+https://seed-sha.local.al.lekensteyn.nl:4470
+https://dhe-dss-seed-sha.local.al.lekensteyn.nl:4471
+https://dhe-rsa-seed-sha.local.al.lekensteyn.nl:4472
+https://ecdh-ecdsa-rc4-sha.local.al.lekensteyn.nl:4479
+https://ecdh-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4480
+https://ecdh-ecdsa-aes128-sha.local.al.lekensteyn.nl:4481
+https://ecdh-ecdsa-aes256-sha.local.al.lekensteyn.nl:4482
+https://ecdhe-ecdsa-rc4-sha.local.al.lekensteyn.nl:4483
+https://ecdhe-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4484
+https://ecdhe-ecdsa-aes128-sha.local.al.lekensteyn.nl:4485
+https://ecdhe-ecdsa-aes256-sha.local.al.lekensteyn.nl:4486
+https://ecdhe-rsa-rc4-sha.local.al.lekensteyn.nl:4491
+https://ecdhe-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4492
+https://ecdhe-rsa-aes128-sha.local.al.lekensteyn.nl:4493
+https://ecdhe-rsa-aes256-sha.local.al.lekensteyn.nl:4494
diff --git a/suites.txt b/suites.txt
new file mode 100644
index 0000000..4c0a768
--- /dev/null
+++ b/suites.txt
@@ -0,0 +1,314 @@
+0 TLS_NULL_WITH_NULL_NULL
+1 TLS_RSA_WITH_NULL_MD5
+2 TLS_RSA_WITH_NULL_SHA
+3 TLS_RSA_EXPORT_WITH_RC4_40_MD5
+4 TLS_RSA_WITH_RC4_128_MD5
+5 TLS_RSA_WITH_RC4_128_SHA
+6 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+7 TLS_RSA_WITH_IDEA_CBC_SHA
+8 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
+9 TLS_RSA_WITH_DES_CBC_SHA
+10 TLS_RSA_WITH_3DES_EDE_CBC_SHA
+11 TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
+12 TLS_DH_DSS_WITH_DES_CBC_SHA
+13 TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
+14 TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
+15 TLS_DH_RSA_WITH_DES_CBC_SHA
+16 TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
+17 TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
+18 TLS_DHE_DSS_WITH_DES_CBC_SHA
+19 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
+20 TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
+21 TLS_DHE_RSA_WITH_DES_CBC_SHA
+22 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
+23 TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
+24 TLS_DH_anon_WITH_RC4_128_MD5
+25 TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
+26 TLS_DH_anon_WITH_DES_CBC_SHA
+27 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
+30 TLS_KRB5_WITH_DES_CBC_SHA
+31 TLS_KRB5_WITH_3DES_EDE_CBC_SHA
+32 TLS_KRB5_WITH_RC4_128_SHA
+33 TLS_KRB5_WITH_IDEA_CBC_SHA
+34 TLS_KRB5_WITH_DES_CBC_MD5
+35 TLS_KRB5_WITH_3DES_EDE_CBC_MD5
+36 TLS_KRB5_WITH_RC4_128_MD5
+37 TLS_KRB5_WITH_IDEA_CBC_MD5
+38 TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
+39 TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA
+40 TLS_KRB5_EXPORT_WITH_RC4_40_SHA
+41 TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
+42 TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5
+43 TLS_KRB5_EXPORT_WITH_RC4_40_MD5
+44 TLS_PSK_WITH_NULL_SHA
+45 TLS_DHE_PSK_WITH_NULL_SHA
+46 TLS_RSA_PSK_WITH_NULL_SHA
+47 TLS_RSA_WITH_AES_128_CBC_SHA
+48 TLS_DH_DSS_WITH_AES_128_CBC_SHA
+49 TLS_DH_RSA_WITH_AES_128_CBC_SHA
+50 TLS_DHE_DSS_WITH_AES_128_CBC_SHA
+51 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+52 TLS_DH_anon_WITH_AES_128_CBC_SHA
+53 TLS_RSA_WITH_AES_256_CBC_SHA
+54 TLS_DH_DSS_WITH_AES_256_CBC_SHA
+55 TLS_DH_RSA_WITH_AES_256_CBC_SHA
+56 TLS_DHE_DSS_WITH_AES_256_CBC_SHA
+57 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
+58 TLS_DH_anon_WITH_AES_256_CBC_SHA
+59 TLS_RSA_WITH_NULL_SHA256
+60 TLS_RSA_WITH_AES_128_CBC_SHA256
+61 TLS_RSA_WITH_AES_256_CBC_SHA256
+62 TLS_DH_DSS_WITH_AES_128_CBC_SHA256
+63 TLS_DH_RSA_WITH_AES_128_CBC_SHA256
+64 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
+65 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
+66 TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
+67 TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
+68 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
+69 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
+70 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
+103 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+104 TLS_DH_DSS_WITH_AES_256_CBC_SHA256
+105 TLS_DH_RSA_WITH_AES_256_CBC_SHA256
+106 TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
+107 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
+108 TLS_DH_anon_WITH_AES_128_CBC_SHA256
+109 TLS_DH_anon_WITH_AES_256_CBC_SHA256
+132 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
+133 TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
+134 TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
+135 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
+136 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
+137 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
+138 TLS_PSK_WITH_RC4_128_SHA
+139 TLS_PSK_WITH_3DES_EDE_CBC_SHA
+140 TLS_PSK_WITH_AES_128_CBC_SHA
+141 TLS_PSK_WITH_AES_256_CBC_SHA
+142 TLS_DHE_PSK_WITH_RC4_128_SHA
+143 TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
+144 TLS_DHE_PSK_WITH_AES_128_CBC_SHA
+145 TLS_DHE_PSK_WITH_AES_256_CBC_SHA
+146 TLS_RSA_PSK_WITH_RC4_128_SHA
+147 TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
+148 TLS_RSA_PSK_WITH_AES_128_CBC_SHA
+149 TLS_RSA_PSK_WITH_AES_256_CBC_SHA
+150 TLS_RSA_WITH_SEED_CBC_SHA
+151 TLS_DH_DSS_WITH_SEED_CBC_SHA
+152 TLS_DH_RSA_WITH_SEED_CBC_SHA
+153 TLS_DHE_DSS_WITH_SEED_CBC_SHA
+154 TLS_DHE_RSA_WITH_SEED_CBC_SHA
+155 TLS_DH_anon_WITH_SEED_CBC_SHA
+156 TLS_RSA_WITH_AES_128_GCM_SHA256
+157 TLS_RSA_WITH_AES_256_GCM_SHA384
+158 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
+159 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+160 TLS_DH_RSA_WITH_AES_128_GCM_SHA256
+161 TLS_DH_RSA_WITH_AES_256_GCM_SHA384
+162 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
+163 TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
+164 TLS_DH_DSS_WITH_AES_128_GCM_SHA256
+165 TLS_DH_DSS_WITH_AES_256_GCM_SHA384
+166 TLS_DH_anon_WITH_AES_128_GCM_SHA256
+167 TLS_DH_anon_WITH_AES_256_GCM_SHA384
+168 TLS_PSK_WITH_AES_128_GCM_SHA256
+169 TLS_PSK_WITH_AES_256_GCM_SHA384
+170 TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
+171 TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
+172 TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
+173 TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
+174 TLS_PSK_WITH_AES_128_CBC_SHA256
+175 TLS_PSK_WITH_AES_256_CBC_SHA384
+176 TLS_PSK_WITH_NULL_SHA256
+177 TLS_PSK_WITH_NULL_SHA384
+178 TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
+179 TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
+180 TLS_DHE_PSK_WITH_NULL_SHA256
+181 TLS_DHE_PSK_WITH_NULL_SHA384
+182 TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
+183 TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
+184 TLS_RSA_PSK_WITH_NULL_SHA256
+185 TLS_RSA_PSK_WITH_NULL_SHA384
+186 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
+187 TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256
+188 TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256
+189 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256
+190 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+191 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256
+192 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
+193 TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256
+194 TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256
+195 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256
+196 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
+197 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256
+255 TLS_EMPTY_RENEGOTIATION_INFO_SCSV
+49153 TLS_ECDH_ECDSA_WITH_NULL_SHA
+49154 TLS_ECDH_ECDSA_WITH_RC4_128_SHA
+49155 TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+49156 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+49157 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+49158 TLS_ECDHE_ECDSA_WITH_NULL_SHA
+49159 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+49160 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+49161 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+49162 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+49163 TLS_ECDH_RSA_WITH_NULL_SHA
+49164 TLS_ECDH_RSA_WITH_RC4_128_SHA
+49165 TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
+49166 TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+49167 TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+49168 TLS_ECDHE_RSA_WITH_NULL_SHA
+49169 TLS_ECDHE_RSA_WITH_RC4_128_SHA
+49170 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+49171 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+49172 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+49173 TLS_ECDH_anon_WITH_NULL_SHA
+49174 TLS_ECDH_anon_WITH_RC4_128_SHA
+49175 TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
+49176 TLS_ECDH_anon_WITH_AES_128_CBC_SHA
+49177 TLS_ECDH_anon_WITH_AES_256_CBC_SHA
+49178 TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA
+49179 TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA
+49180 TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA
+49181 TLS_SRP_SHA_WITH_AES_128_CBC_SHA
+49182 TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA
+49183 TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA
+49184 TLS_SRP_SHA_WITH_AES_256_CBC_SHA
+49185 TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA
+49186 TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA
+49187 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+49188 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
+49189 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
+49190 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
+49191 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+49192 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+49193 TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
+49194 TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
+49195 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+49196 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+49197 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
+49198 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
+49199 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+49200 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+49201 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
+49202 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
+49203 TLS_ECDHE_PSK_WITH_RC4_128_SHA
+49204 TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
+49205 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
+49206 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
+49207 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
+49208 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
+49209 TLS_ECDHE_PSK_WITH_NULL_SHA
+49210 TLS_ECDHE_PSK_WITH_NULL_SHA256
+49211 TLS_ECDHE_PSK_WITH_NULL_SHA384
+49212 TLS_RSA_WITH_ARIA_128_CBC_SHA256
+49213 TLS_RSA_WITH_ARIA_256_CBC_SHA384
+49214 TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256
+49215 TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384
+49216 TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256
+49217 TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384
+49218 TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256
+49219 TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384
+49220 TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256
+49221 TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384
+49222 TLS_DH_anon_WITH_ARIA_128_CBC_SHA256
+49223 TLS_DH_anon_WITH_ARIA_256_CBC_SHA384
+49224 TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256
+49225 TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384
+49226 TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256
+49227 TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384
+49228 TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256
+49229 TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384
+49230 TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256
+49231 TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384
+49232 TLS_RSA_WITH_ARIA_128_GCM_SHA256
+49233 TLS_RSA_WITH_ARIA_256_GCM_SHA384
+49234 TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256
+49235 TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384
+49236 TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256
+49237 TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384
+49238 TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256
+49239 TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384
+49240 TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256
+49241 TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384
+49242 TLS_DH_anon_WITH_ARIA_128_GCM_SHA256
+49243 TLS_DH_anon_WITH_ARIA_256_GCM_SHA384
+49244 TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256
+49245 TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384
+49246 TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256
+49247 TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384
+49248 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
+49249 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
+49250 TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256
+49251 TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384
+49252 TLS_PSK_WITH_ARIA_128_CBC_SHA256
+49253 TLS_PSK_WITH_ARIA_256_CBC_SHA384
+49254 TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256
+49255 TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384
+49256 TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256
+49257 TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384
+49258 TLS_PSK_WITH_ARIA_128_GCM_SHA256
+49259 TLS_PSK_WITH_ARIA_256_GCM_SHA384
+49260 TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256
+49261 TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384
+49262 TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256
+49263 TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384
+49264 TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
+49265 TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
+49266 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+49267 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+49268 TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+49269 TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+49270 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+49271 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
+49272 TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
+49273 TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
+49274 TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
+49275 TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
+49276 TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
+49277 TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
+49278 TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256
+49279 TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384
+49280 TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256
+49281 TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384
+49282 TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256
+49283 TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384
+49284 TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256
+49285 TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384
+49286 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+49287 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+49288 TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+49289 TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+49290 TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
+49291 TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
+49292 TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
+49293 TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
+49294 TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
+49295 TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
+49296 TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
+49297 TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
+49298 TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
+49299 TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
+49300 TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
+49301 TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
+49302 TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+49303 TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+49304 TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
+49305 TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
+49306 TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+49307 TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+49308 TLS_RSA_WITH_AES_128_CCM
+49309 TLS_RSA_WITH_AES_256_CCM
+49310 TLS_DHE_RSA_WITH_AES_128_CCM
+49311 TLS_DHE_RSA_WITH_AES_256_CCM
+49312 TLS_RSA_WITH_AES_128_CCM_8
+49313 TLS_RSA_WITH_AES_256_CCM_8
+49314 TLS_DHE_RSA_WITH_AES_128_CCM_8
+49315 TLS_DHE_RSA_WITH_AES_256_CCM_8
+49316 TLS_PSK_WITH_AES_128_CCM
+49317 TLS_PSK_WITH_AES_256_CCM
+49318 TLS_DHE_PSK_WITH_AES_128_CCM
+49319 TLS_DHE_PSK_WITH_AES_256_CCM
+49320 TLS_PSK_WITH_AES_128_CCM_8
+49321 TLS_PSK_WITH_AES_256_CCM_8
+49322 TLS_PSK_DHE_WITH_AES_128_CCM_8
+49323 TLS_PSK_DHE_WITH_AES_256_CCM_8
diff --git a/tls/all/ciphers-V-broken.txt b/tls/all/ciphers-V-broken.txt
new file mode 100644
index 0000000..f190408
--- /dev/null
+++ b/tls/all/ciphers-V-broken.txt
@@ -0,0 +1,33 @@
+ 0xC0,0x14 - ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
+ 0xC0,0x0A - ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
+ 0x00,0x39 - DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
+ 0x00,0x38 - DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1
+ 0x00,0x88 - DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
+ 0x00,0x87 - DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(256) Mac=SHA1
+ 0xC0,0x05 - ECDH-ECDSA-AES256-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256) Mac=SHA1
+ 0x00,0x35 - AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
+ 0x00,0x84 - CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1
+ 0xC0,0x12 - ECDHE-RSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=RSA Enc=3DES(168) Mac=SHA1
+ 0xC0,0x08 - ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=3DES(168) Mac=SHA1
+ 0x00,0x16 - EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1
+ 0x00,0x13 - EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1
+ 0xC0,0x03 - ECDH-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=3DES(168) Mac=SHA1
+ 0x00,0x0A - DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
+ 0xC0,0x13 - ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
+ 0xC0,0x09 - ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
+ 0x00,0x33 - DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
+ 0x00,0x32 - DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1
+ 0x00,0x9A - DHE-RSA-SEED-SHA SSLv3 Kx=DH Au=RSA Enc=SEED(128) Mac=SHA1
+ 0x00,0x99 - DHE-DSS-SEED-SHA SSLv3 Kx=DH Au=DSS Enc=SEED(128) Mac=SHA1
+ 0x00,0x45 - DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1
+ 0x00,0x44 - DHE-DSS-CAMELLIA128-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(128) Mac=SHA1
+ 0xC0,0x04 - ECDH-ECDSA-AES128-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(128) Mac=SHA1
+ 0x00,0x2F - AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
+ 0x00,0x96 - SEED-SHA SSLv3 Kx=RSA Au=RSA Enc=SEED(128) Mac=SHA1
+ 0x00,0x41 - CAMELLIA128-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA1
+ 0x00,0x07 - IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1
+ 0x00,0x15 - EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1
+ 0x00,0x12 - EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1
+ 0x00,0x09 - DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
+ 0x00,0x08 - EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
+ 0x00,0x06 - EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
diff --git a/tls/all/ciphers-V-works.txt b/tls/all/ciphers-V-works.txt
new file mode 100644
index 0000000..c3bd131
--- /dev/null
+++ b/tls/all/ciphers-V-works.txt
@@ -0,0 +1,6 @@
+ 0xC0,0x11 - ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1
+ 0xC0,0x07 - ECDHE-ECDSA-RC4-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=RC4(128) Mac=SHA1
+ 0xC0,0x02 - ECDH-ECDSA-RC4-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=RC4(128) Mac=SHA1
+ 0x00,0x05 - RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
+ 0x00,0x04 - RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
+ 0x00,0x03 - EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
diff --git a/tls/all/debug.txt b/tls/all/debug.txt
new file mode 100644
index 0000000..668877e
--- /dev/null
+++ b/tls/all/debug.txt
@@ -0,0 +1,20504 @@
+Wireshark SSL debug log
+
+
+dissect_ssl enter frame #4 (first time)
+ssl_session_init: initializing ptr 0x7facc380f060 size 688
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 40165 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4434
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #6 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session can't find stored session
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+found master secret in key log
+ cannot find master secret in keylog file either
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..|
+| bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.|
+| 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..|
+| e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. |
+hash out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+PRF out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+key expansion[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 f7 1b 5e 87 |...^. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+PRF out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| bd 24 1f e8 5a |.$..Z |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+PRF out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+Client MAC key[16]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+Server MAC key[16]:
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+Client Write key[16]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+Server Write key[16]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 52 11 00 00 00 00 00 00 |R....... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab...
+looking for RSA pre-masteraaf9896cd26391408e582a9fe4c1454d18e1935c79f420c9...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..|
+| bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.|
+| 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..|
+| e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. |
+hash out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+PRF out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+key expansion[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 f7 1b 5e 87 |...^. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+PRF out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| bd 24 1f e8 5a |.$..Z |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+PRF out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+Client MAC key[16]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+Server MAC key[16]:
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+Client Write key[16]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+Server Write key[16]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ab 1f 53 b0 d4 2c d5 d9 3a d2 9d 10 94 17 c2 c7 |..S..,..:.......|
+| 8f 46 0e 99 0b 6e eb a6 95 9e 9d 41 31 7a b5 71 |.F...n.....A1z.q|
+Plaintext[32]:
+| 14 00 00 0c 5d c6 d2 8c 1a 80 f1 2e fb 70 e7 68 |....]........p.h|
+| 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 7b 0f 3a 4f 01 75 7f c4 33 6f 0a bc a6 a2 50 67 |{.:O.u..3o....Pg|
+| a4 c8 58 70 89 81 ed 24 6d 43 34 8c 9c ca 15 e0 |..Xp...$mC4.....|
+Plaintext[32]:
+| 14 00 00 0c 0b 09 b9 f9 94 8b 80 5f e6 42 81 6b |..........._.B.k|
+| 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 3e 0d ba 3e 4a 7e 7a 46 bf b9 9c 3f 31 f8 b2 0f |>..>J~zF...?1...|
+| 69 64 7c 7a 30 22 ce 38 45 4b 81 31 00 a9 41 57 |id|z0".8EK.1..AW|
+| b4 dd 58 41 f0 0e 11 23 4b 29 44 47 46 73 b3 7f |..XA...#K)DGFs..|
+| ed 45 37 c9 3b 0c 33 4f 55 54 f0 21 c1 05 0b 19 |.E7.;.3OUT.!....|
+| 9a be 8f 5d c4 70 c9 60 74 b0 94 5b 23 ee 84 a6 |...].p.`t..[#...|
+| 48 |H |
+ssl_decrypt_record: allocating 113 bytes for decrypt data (old len 32)
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 |.C"..-........N.|
+| 2f |/ |
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 2f |C"..-........N./|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65
+association_find: TCP port 40165 found (nil)
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #11 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 371, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 371
+Ciphertext[371]:
+| b6 de 1f 5a df ae ce 3e 4a 6e 21 25 a2 47 06 25 |...Z...>Jn!%.G.%|
+| f6 fd bb 49 e7 a4 6a bc 89 32 6f 22 14 eb 8f 3e |...I..j..2o"...>|
+| 05 bc d5 bf df b2 19 7b 64 fa 62 c5 96 15 7b 0a |.......{d.b...{.|
+| a6 50 cd d2 4c 3f 5c 2b 20 fc 8b d4 d9 2b db 99 |.P..L?\+ ....+..|
+| e4 14 36 ec 8d dd 42 74 20 e6 fa c6 34 1a d1 b6 |..6...Bt ...4...|
+| 2d 74 a1 00 7b 11 e2 a8 70 f1 96 63 32 0b 44 4f |-t..{...p..c2.DO|
+| b1 45 25 70 71 74 95 28 7f 55 5b e4 f3 39 df 53 |.E%pqt.(.U[..9.S|
+| 14 e4 5a 3a 43 f5 9d 0b 9d ad 81 ff 06 fe 57 eb |..Z:C.........W.|
+| f0 b9 e1 c9 14 45 1c 55 7b 26 da 08 6d a1 0b 71 |.....E.U{&..m..q|
+| a1 60 e9 c3 2e a1 a3 89 58 5e 21 6a 17 98 2d dd |.`......X^!j..-.|
+| b4 09 e8 af 88 2b 58 f1 66 23 38 95 f3 32 ad 59 |.....+X.f#8..2.Y|
+| 62 cf cb fc c3 84 fd 33 5a 45 5e 61 28 10 f3 2c |b......3ZE^a(..,|
+| 69 73 af 99 37 44 55 ab 1f 1d 17 be 38 cb f0 6b |is..7DU.....8..k|
+| 79 ea bf 8f 80 d4 49 6b 20 2c 57 c9 b1 48 d7 7a |y.....Ik ,W..H.z|
+| f9 f2 4a 56 cd 68 20 34 d9 47 27 fe 00 6b 19 07 |..JV.h 4.G'..k..|
+| 2c 55 ac 38 35 b1 98 e9 bb 02 ed ab 01 c9 38 2c |,U.85.........8,|
+| 87 2e b0 da d3 7d 5b 39 07 cb fb f3 6d 95 91 9c |.....}[9....m...|
+| 84 92 90 3c 34 7f ed aa 7e 22 e9 99 a5 b4 90 7b |...<4...~".....{|
+| 61 f9 6b 96 b7 3c a8 27 76 e6 87 35 d4 f9 67 67 |a.k..<.'v..5..gg|
+| f2 64 bb e3 6e a9 12 ab 42 e3 ca 14 90 44 c2 e6 |.d..n...B....D..|
+| 76 ad e2 f6 17 af a7 68 fd b0 21 95 f2 bb d6 b6 |v......h..!.....|
+| e2 fb 59 af 27 31 d9 f1 4d 2f fb d8 d8 b3 06 48 |..Y.'1..M/.....H|
+| ab 1a af 4d a3 79 58 19 a9 42 ce c2 e0 c1 bd 83 |...M.yX..B......|
+| dc 58 e3 |.X. |
+ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 113)
+Plaintext[371]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d |pt>....;D..f..G-|
+| dd 1e eb |... |
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d dd 1e eb |....;D..f..G-...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #12 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 35 00 7c 44 00 05 fc 63 be 79 45 3f d5 59 a6 77 |5.|D...c.yE?.Y.w|
+| a4 7a |.z |
+Plaintext[18]:
+| 01 00 e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 |...a4...U.....R.|
+| 8f b2 |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 8f b2 |.a4...U.....R...|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #14 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| f9 ee 0f 6c 4b 2e f9 71 f6 c7 eb d5 b4 cb 78 2a |...lK..q......x*|
+| c7 a3 |.. |
+Plaintext[18]:
+| 01 00 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 |..{[..3^...+..ZX|
+| 1d a0 |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 1d a0 |{[..3^...+..ZX..|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #19 (first time)
+ssl_session_init: initializing ptr 0x7facc38119d0 size 688
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46195 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4435
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #21 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{|
+| 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.|
+| 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....|
+| 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... |
+hash out[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+PRF out[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+key expansion[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+Client MAC key[16]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+Server MAC key[16]:
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+Client Write key[16]:
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+Server Write key[16]:
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #23 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 310
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364e...
+looking for RSA pre-master808f0a3961b6859682b36eb63335dbdfe3e0ea7aa788787e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{|
+| 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.|
+| 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....|
+| 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... |
+hash out[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+PRF out[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+key expansion[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+Client MAC key[16]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+Server MAC key[16]:
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+Client Write key[16]:
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+Server Write key[16]:
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 bd 73 03 00 00 00 00 |@.s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e8 4a 32 ba 83 bb c0 cd 12 c5 82 7e f5 d4 95 6d |.J2........~...m|
+| 72 f4 32 fd e4 31 29 10 48 6a 07 2f 47 77 04 94 |r.2..1).Hj./Gw..|
+Plaintext[32]:
+| 14 00 00 0c c8 4b 0b 55 9f 72 f5 13 a3 e9 69 bf |.....K.U.r....i.|
+| 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #24 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 44 03 b0 93 8e 51 2a 28 92 af d6 37 31 c9 4c 90 |D....Q*(...71.L.|
+| dc be 73 5e 73 74 bd ca 03 c8 ad 34 08 23 1c b4 |..s^st.....4.#..|
+Plaintext[32]:
+| 14 00 00 0c 18 0b 80 a3 9b d5 02 4c 96 a6 a1 65 |...........L...e|
+| 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #25 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 82
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 77, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 77
+Ciphertext[77]:
+| 60 6f e0 5f f0 8a 20 20 46 e7 f5 44 f8 57 c7 1d |`o._.. F..D.W..|
+| 00 82 b8 12 b4 3f 78 97 43 ef ac be dd 6a 76 29 |.....?x.C....jv)|
+| cb 31 5b 62 64 70 ed 86 fc 60 5c dd f3 8b d5 c0 |.1[bdp...`\.....|
+| 38 61 b7 a7 df be 5d 3a 30 66 19 54 be 3c 35 cd |8a....]:0f.T.<5.|
+| 14 27 47 24 73 56 61 84 0e 42 9c e5 5f |.'G$sVa..B.._ |
+Plaintext[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a 21 89 fe |n.nl:4435....!..|
+| cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |....!o...F... |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 21 89 fe cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |!......!o...F...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 46195 found (nil)
+association_find: TCP port 4435 found 0x34254c0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... |
+dissect_ssl3_record found association 0x34254c0
+
+dissect_ssl enter frame #26 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 368
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 363, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 363
+Ciphertext[363]:
+| e5 44 fb 83 4b 56 20 00 62 db a3 09 c9 55 30 0b |.D..KV .b....U0.|
+| 9e 0c 85 05 a6 a4 47 92 3a 04 7d 8c bc 71 1e 1c |......G.:.}..q..|
+| 6d a8 a6 40 d3 a6 42 64 e0 ea c7 b5 a9 92 dd 31 |m..@..Bd.......1|
+| fc 75 04 55 f1 24 8d 54 44 3e 8a f1 0f a6 8d a1 |.u.U.$.TD>......|
+| bb e1 20 7c 2e ee 89 5f 88 5c 9f 2c 41 ea b3 92 |.. |..._.\.,A...|
+| c1 99 6f 92 d2 ca 7b 66 3e bd f3 ce 94 1c 0e 20 |..o...{f>...... |
+| 03 75 48 62 b7 98 1c 70 fd 8c 66 80 ff 5d 91 c6 |.uHb...p..f..]..|
+| 39 9a 42 b8 92 bc 6c 97 bc 77 92 37 01 c5 24 59 |9.B...l..w.7..$Y|
+| 85 0b f1 a0 89 1e 46 53 58 6e f4 64 54 47 87 77 |......FSXn.dTG.w|
+| c7 eb f7 16 40 18 74 44 98 69 d3 49 cf b0 9a 83 |....@.tD.i.I....|
+| 86 b4 a0 46 c6 42 ce ee f0 f5 fb c2 47 19 d3 01 |...F.B......G...|
+| ce 90 3c ac 4a e1 82 f4 19 81 7c b8 dc db a5 34 |..<.J.....|....4|
+| 3c ac 6c 98 db 64 b1 8f 7e 8d 45 64 99 1e b7 c3 |<.l..d..~.Ed....|
+| 16 50 2c 09 57 61 d3 aa e8 f9 bd a2 cd 65 d1 1f |.P,.Wa.......e..|
+| d2 6c 3b f7 6c 57 2c 3c 9e 85 95 4b e9 b4 54 ee |.l;.lW,<...K..T.|
+| ba 85 bc 7e 92 dc 85 54 86 db ef b0 bd 76 2a d6 |...~...T.....v*.|
+| 8f d3 4a f0 e0 a9 ba 89 24 3d 6b 71 c1 31 7e 91 |..J.....$=kq.1~.|
+| c3 3e e1 4a da 23 5a 0a 2a 82 15 85 b0 b1 0e f0 |.>.J.#Z.*.......|
+| 64 88 a1 75 ad 0a 9c 9c b1 ab 12 a8 90 38 69 a9 |d..u.........8i.|
+| fd 3e cb 85 45 a1 32 42 fd ba 77 f7 53 74 f8 17 |.>..E.2B..w.St..|
+| ca 5f d6 d8 f8 99 99 85 47 14 e6 cd 4f 0f 76 d5 |._......G...O.v.|
+| 1d bc 93 22 53 75 56 a2 34 0f ed 53 d7 2b a5 27 |..."SuV.4..S.+.'|
+| 6a 17 c8 e0 f7 04 2a 86 da c3 33 |j.....*...3 |
+Plaintext[363]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 14 32 51 46 1a |l'</script>.2QF.|
+| 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |^s......a.. |
+checking mac (len 347, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 14 32 51 46 1a 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |.2QF.^s......a..|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347
+association_find: TCP port 4435 found 0x34254c0
+dissect_ssl3_record decrypted len 347
+decrypted app data fragment[347]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e |l'</script> |
+dissect_ssl3_record found association 0x34254c0
+
+dissect_ssl enter frame #27 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| fa 16 da a9 91 b0 7c 04 81 10 a2 25 50 28 d2 07 |......|....%P(..|
+| ac 34 |.4 |
+Plaintext[18]:
+| 01 00 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 |.......B...8.np.|
+| 34 a4 |4. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 34 a4 |.....B...8.np.4.|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #29 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 69 b5 40 b5 50 76 16 cc 5b 06 0d 7f c4 24 6b 1a |i.@.Pv..[....$k.|
+| dc 72 |.r |
+Plaintext[18]:
+| 01 00 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 |...%5n......#..b|
+| c0 36 |.6 |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 c0 36 |.%5n......#..b.6|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #34 (first time)
+ssl_session_init: initializing ptr 0x7facc3814390 size 688
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52548 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4436
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #36 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..|
+| da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.|
+| 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z|
+| 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |....<N.~.E.9. |
+hash out[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+PRF out[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+key expansion[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+Client MAC key[20]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 |dt.. |
+Server MAC key[20]:
+| d0 96 ab db 02 a7 a3 67 a8 24 dc ce b7 9c 03 1f |.......g.$......|
+| ad 04 25 e2 |..%. |
+Client Write key[16]:
+| d9 28 da 0a 59 18 53 a3 a6 21 54 e0 c0 6b 63 4a |.(..Y.S..!T..kcJ|
+Server Write key[16]:
+| 79 96 6d 4a 8e 13 7a 38 d1 4c fd 88 3a ba 89 16 |y.mJ..z8.L..:...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #38 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 314
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c...
+looking for RSA pre-masterb6af8c30c49aaae7d853096e912562724f72c45dc8a26642...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..|
+| da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.|
+| 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z|
+| 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |....<N.~.E.9. |
+hash out[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+PRF out[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+key expansion[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+Client MAC key[20]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b |..|{ |
+Server MAC key[20]:
+| d4 d8 49 cf e1 14 5a c8 86 34 05 3c f5 e5 b7 ff |..I...Z..4.<....|
+| f5 e9 9e c8 |.... |
+Client Write key[16]:
+| ad 1d f6 13 87 b3 cd 7c 8c c2 8a f2 51 d5 9d 09 |.......|....Q...|
+Server Write key[16]:
+| 5a 07 8f c9 cf 20 ab f2 41 6e 17 77 ac d9 cf c2 |Z.... ..An.w....|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 48 c5 28 a0 67 ce 6f 73 b3 ca 86 90 1d 1d 9c f2 |H.(.g.os........|
+| 6b f6 8a 52 24 31 22 e7 4e 2c 38 ad e6 85 ca 9c |k..R$1".N,8.....|
+| 2f f8 1d ec |/... |
+Plaintext[36]:
+| 14 00 00 0c 5e 22 3c 93 0e 06 30 b7 48 68 6e 8f |....^"<...0.Hhn.|
+| 25 99 76 9c fe af 82 ba 9d 4c c6 9c d7 92 dd de |%.v......L......|
+| 27 e9 ad 2a |'..* |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 99 76 9c fe af 82 ba 9d 4c c6 9c d7 92 dd de |%.v......L......|
+| 27 e9 ad 2a |'..* |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #39 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 51 e6 e8 5e 4e 01 4d a8 2b 86 6b 7f fa ca e4 3f |Q..^N.M.+.k....?|
+| da bf d5 17 d4 ac 4c 6a 18 86 4c a0 02 00 86 5b |......Lj..L....[|
+| 60 ac 83 bd |`... |
+Plaintext[36]:
+| 14 00 00 0c 26 b7 15 da 6e e8 de 93 82 69 0a a0 |....&...n....i..|
+| 92 ff 7b 6f fa 21 23 6f e4 ec e9 ac 44 4c 37 ca |..{o.!#o....DL7.|
+| 18 4a 67 b4 |.Jg. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 92 ff 7b 6f fa 21 23 6f e4 ec e9 ac 44 4c 37 ca |..{o.!#o....DL7.|
+| 18 4a 67 b4 |.Jg. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #40 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 71 8c 78 49 55 b2 7d d0 54 53 7b 45 da a7 14 4c |q.xIU.}.TS{E...L|
+| d2 d6 43 63 a1 02 3c 1e 36 6f 1d 7d 70 c3 7c 76 |..Cc..<.6o.}p.|v|
+| aa 80 ea f4 59 b9 b4 88 09 ad d6 5d f4 37 5e b8 |....Y......].7^.|
+| 93 4b 36 e3 c6 89 4b 7d b4 ea 25 9a a6 31 e2 64 |.K6...K}..%..1.d|
+| 6a 26 ec 66 7d e0 ab ed 81 15 7e c7 22 4f 33 b5 |j&.f}.....~."O3.|
+| f5 |. |
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a 4e ef 09 |n.nl:4436....N..|
+| 10 a3 0c b7 a7 18 03 12 27 05 de 68 e4 7a 9b b9 |........'..h.z..|
+| 69 |i |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e ef 09 10 a3 0c b7 a7 18 03 12 27 05 de 68 e4 |N..........'..h.|
+| 7a 9b b9 69 |z..i |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 52548 found (nil)
+association_find: TCP port 4436 found 0x342d9a0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a |n.nl:4436.... |
+dissect_ssl3_record found association 0x342d9a0
+
+dissect_ssl enter frame #41 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| dd 76 6d d3 37 22 56 3b 8d e8 d7 8a d0 8d e8 d4 |.vm.7"V;........|
+| a6 9b b1 dd 3f 5f cf 57 37 84 23 1f da 94 d7 b8 |....?_.W7.#.....|
+| aa 25 8e 2b cf a4 58 5a 15 9c de dc 39 78 c6 c8 |.%.+..XZ....9x..|
+| 43 1b a8 2d 41 8d 42 1f 19 e1 da 12 e8 82 2d e1 |C..-A.B.......-.|
+| b6 c3 25 5e c4 55 3b 3f d3 4e 07 10 7e bb df 5d |..%^.U;?.N..~..]|
+| 69 70 5e 5a ed 24 92 e4 9e e3 2f 75 ac 6d 44 26 |ip^Z.$..../u.mD&|
+| f2 f0 95 fc 5a f8 ca 96 d7 11 7e 93 eb 23 1d 7a |....Z.....~..#.z|
+| b1 20 12 8e c6 13 5e b9 11 b0 ea 22 67 58 2c 04 |. ....^...."gX,.|
+| 09 07 3b 27 c6 c1 06 0e 89 93 c1 a9 2e af ca 3d |..;'...........=|
+| dc ee 57 82 a1 fd 71 33 07 3a 4a fb d0 88 1f 65 |..W...q3.:J....e|
+| 45 8c 62 b3 c1 5e 50 37 24 12 4e e7 59 a8 8e 23 |E.b..^P7$.N.Y..#|
+| c8 b8 37 01 43 7a f6 a9 c8 c7 0f aa b5 f9 f9 e6 |..7.Cz..........|
+| a7 65 b5 e7 bb 58 79 12 b1 07 08 df ee c1 52 96 |.e...Xy.......R.|
+| 3a af a3 c3 42 9f fd 0b 00 5b fc 4e 9b 36 41 15 |:...B....[.N.6A.|
+| bf d6 15 1e bf d3 bc 17 d2 e6 cb 50 2a 3e 14 1d |...........P*>..|
+| c2 f3 17 f7 24 52 a7 e5 34 fc 60 d5 6d dd 4f 14 |....$R..4.`.m.O.|
+| 59 cc 1b 0f f1 56 b1 0c 86 d6 8e 87 86 11 03 25 |Y....V.........%|
+| 82 92 c5 4a 93 cc 21 d4 d0 19 30 87 89 4c 43 26 |...J..!...0..LC&|
+| 95 3d 7e 3e c9 55 f7 51 f4 53 44 68 07 73 d2 91 |.=~>.U.Q.SDh.s..|
+| 98 c3 6a 70 eb dc ba 10 69 a6 5d 67 8a 94 8e 4b |..jp....i.]g...K|
+| eb 5c ff 7d 42 5b a3 e6 e2 ca bd 93 ee c4 63 86 |.\.}B[........c.|
+| 54 c7 32 94 38 72 e2 74 13 d6 af 28 df 08 a8 b3 |T.2.8r.t...(....|
+| 4c c2 ae 34 65 c5 4d 57 82 84 79 ed a4 73 ec 70 |L..4e.MW..y..s.p|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d9 c6 84 44 |nl'</script>...D|
+| d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d bf e3 39 c6 |..j.RM. .-.-..9.|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d9 c6 84 44 d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d |...D..j.RM. .-.-|
+| bf e3 39 c6 |..9. |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4436 found 0x342d9a0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x342d9a0
+
+dissect_ssl enter frame #42 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| c3 a9 02 80 e9 7a a0 63 1f a4 c7 42 9e c7 dc 1f |.....z.c...B....|
+| d5 55 d1 72 c5 f9 |.U.r.. |
+Plaintext[22]:
+| 01 00 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 |...d...F.....].V|
+| d0 da 1c 60 1c 1c |...`.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 d0 da |.d...F.....].V..|
+| 1c 60 1c 1c |.`.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #44 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 5b d4 68 03 7d 40 b8 58 7d ab 4d 7c f6 23 5a e4 |[.h.}@.X}.M|.#Z.|
+| 6e e1 65 3d d7 39 |n.e=.9 |
+Plaintext[22]:
+| 01 00 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e |..k.%%..k....`.N|
+| 77 1d 22 f9 26 74 |w.".&t |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e 77 1d |k.%%..k....`.Nw.|
+| 22 f9 26 74 |".&t |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #49 (first time)
+ssl_session_init: initializing ptr 0x7facc3816d50 size 688
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 43026 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4437
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #51 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V|
+| f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.|
+| 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.|
+| 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. |
+hash out[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+PRF out[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+key expansion[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC|
+| 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.|
+| e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....|
+| 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.|
+| 0e 56 49 f3 e4 0d 3f 05 |.VI...?. |
+hash out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+PRF out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 18 80 94 6b 52 |...kR |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+| 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....|
+PRF out[32]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+| 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 9f e0 4c dc 83 |..L.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+| 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....|
+PRF out[32]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+| 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....|
+Client MAC key[20]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 |...G |
+Server MAC key[20]:
+| 0d f7 7c aa cf a0 16 1b e7 db af 5c d5 2e 93 4b |..|........\...K|
+| 06 19 5b 82 |..[. |
+Client Write key[16]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+Server Write key[16]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+Client Write IV[8]:
+| fd 78 18 71 b0 eb fe a5 |.x.q.... |
+Server Write IV[8]:
+| c0 3c 36 49 53 84 f8 e2 |.<6IS... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #53 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8...
+looking for RSA pre-master79a1d2e1fa7136af7a5de4145176273ffdbedd17620baa6d...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0e b9 e2 59 80 8e 59 22 37 ec 51 b4 96 7b 67 ef |...Y..Y"7.Q..{g.|
+| 3b 18 f9 48 c1 b4 0d 7f 78 e3 70 15 49 4c 99 d9 |;..H....x.p.IL..|
+| 51 09 01 5c 42 ee 03 6d d5 9f 0a c4 5b 16 79 d8 |Q..\B..m....[.y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V|
+| f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.|
+| 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.|
+| 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. |
+hash out[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+PRF out[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+key expansion[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC|
+| 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.|
+| e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....|
+| 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.|
+| 0e 56 49 f3 e4 0d 3f 05 |.VI...?. |
+hash out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+PRF out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 73 03 5d 6b 6d |s.]km |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+| 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F|
+PRF out[32]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+| 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 4d 3d 4f 82 10 |M=O.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+| 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....|
+PRF out[32]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+| 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....|
+Client MAC key[20]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 |...& |
+Server MAC key[20]:
+| ff 51 b2 15 12 44 b2 ea 56 96 32 4f f4 1d 64 80 |.Q...D..V.2O..d.|
+| 18 30 43 d7 |.0C. |
+Client Write key[16]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+Server Write key[16]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+Client Write IV[8]:
+| fd 78 18 71 b0 eb fe a5 |.x.q.... |
+Server Write IV[8]:
+| c0 3c 36 49 53 84 f8 e2 |.<6IS... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_handshake can't generate keyring material
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 74 offset 86 length 10589566 bytes, remaining 134
+
+dissect_ssl enter frame #54 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 215 offset 186 length 3870598 bytes, remaining 234
+
+dissect_ssl enter frame #55 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 43026 found (nil)
+association_find: TCP port 4437 found 0x2defbd0
+
+dissect_ssl enter frame #56 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 4437 found 0x2defbd0
+
+dissect_ssl enter frame #57 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #59 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #64 (first time)
+ssl_session_init: initializing ptr 0x7facc3818bb0 size 688
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53104 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4438
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #66 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...|
+| a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.|
+| 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.|
+| ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s |
+hash out[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+PRF out[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+key expansion[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+Client MAC key[20]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 |0/.I |
+Server MAC key[20]:
+| c1 fd 09 90 43 b5 cc fc 7d e9 49 da 7c 52 cc 2c |....C...}.I.|R.,|
+| 1d 7a 08 be |.z.. |
+Client Write key[16]:
+| 1d 78 c1 3b d8 0b 4a da 1f 99 04 f8 bb f8 77 b9 |.x.;..J.......w.|
+Server Write key[16]:
+| e4 44 6c 9e fc 09 63 83 54 c7 fa 1e 77 7a a1 3f |.Dl...c.T...wz.?|
+Client Write IV[8]:
+| 8b 79 54 db 51 41 6b 8e |.yT.QAk. |
+Server Write IV[8]:
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #68 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc...
+looking for RSA pre-master1e816a2993b66faaadfc0adb44c121991b995cb2f6a087fd...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...|
+| a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.|
+| 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.|
+| ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s |
+hash out[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+PRF out[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+key expansion[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+Client MAC key[20]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 |.... |
+Server MAC key[20]:
+| a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f e2 11 0c b2 |..:.....\U......|
+| 0a cb 9f 18 |.... |
+Client Write key[16]:
+| 0a cb 83 a3 c8 85 12 10 a9 bc 14 c6 87 7f a0 04 |................|
+Server Write key[16]:
+| 86 5f d1 b0 90 d2 4a a0 b3 4f 05 eb 82 60 7c cc |._....J..O...`|.|
+Client Write IV[8]:
+| 08 40 48 fb 65 45 97 d5 |.@H.eE.. |
+Server Write IV[8]:
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 90 67 7f e3 85 ed c9 ce b8 59 1d 0e dd 63 72 c7 |.g.......Y...cr.|
+| dc 2c 7f b3 12 f5 35 3f e1 6e c9 86 1f c5 f9 f3 |.,....5?.n......|
+| 6d dc 27 9a 09 0b 33 6b 1a 7c d4 c8 c9 20 fb e3 |m.'...3k.|... ..|
+Plaintext[48]:
+| 23 d6 42 31 8c 7b 61 dd 14 00 00 0c fb 18 0a bd |#.B1.{a.........|
+| 93 02 8d 0d 90 9f 15 3e af c7 ad a0 87 09 fd c5 |.......>........|
+| 06 14 d2 0f ef 6d 65 7f d9 95 cc 08 03 03 03 03 |.....me.........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| af c7 ad a0 87 09 fd c5 06 14 d2 0f ef 6d 65 7f |.............me.|
+| d9 95 cc 08 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #69 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d3 c0 58 c5 c6 54 86 69 26 a1 05 7b a0 51 56 27 |..X..T.i&..{.QV'|
+| 04 87 d5 d3 a1 aa 2a 0c b4 ff 67 18 5c d6 6c 7a |......*...g.\.lz|
+| 51 5e b2 ca 39 16 97 83 0f 7d 53 6b ce 1d f9 0c |Q^..9....}Sk....|
+Plaintext[48]:
+| 4c 1e 65 ed 4e 48 04 aa 14 00 00 0c 34 18 13 9c |L.e.NH......4...|
+| a0 66 7e c4 d8 16 e1 99 83 f4 97 23 d3 ab 38 ee |.f~........#..8.|
+| 48 cf 03 c3 fe 7a 83 45 fc 8e 76 93 03 03 03 03 |H....z.E..v.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 83 f4 97 23 d3 ab 38 ee 48 cf 03 c3 fe 7a 83 45 |...#..8.H....z.E|
+| fc 8e 76 93 |..v. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #70 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 35 ac 8b 9f 80 f7 30 f4 b4 b9 f5 76 f4 d9 1b 8c |5.....0....v....|
+| 0d e2 28 53 7d 25 da 5a 67 97 68 e2 25 fb d6 1c |..(S}%.Zg.h.%...|
+| a0 65 e1 8e 09 be af d4 83 56 7e 64 75 a6 01 95 |.e.......V~du...|
+| 77 aa a9 5b b3 5f 5b b4 fa 49 e8 75 17 db 93 24 |w..[._[..I.u...$|
+| ae 54 5f 7d bb ae 0a 71 ef 99 08 51 3f e8 7e b3 |.T_}...q...Q?.~.|
+| a7 4b 50 96 00 fe 30 ba a5 65 e9 c0 5c 73 30 5e |.KP...0..e..\s0^|
+Plaintext[96]:
+| 38 2c d3 47 db 0c 21 dc 47 45 54 20 2f 20 48 54 |8,.G..!.GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 69 64 |TP/1.1..Host: id|
+| 65 61 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c |ea-cbc-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 33 38 0d 0a 0d 0a 37 97 29 df 25 2d |l:4438....7.).%-|
+| 1b 20 23 1a 1f 82 38 b3 60 3a fc 86 56 bf 01 01 |. #...8.`:..V...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 18 e2 ff 6a ca cb df 36 19 d5 8b 05 26 56 5e 1e |...j...6....&V^.|
+| fb 71 bc 39 |.q.9 |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53104 found (nil)
+association_find: TCP port 4438 found 0x3425920
+
+dissect_ssl enter frame #71 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| a1 45 b9 97 64 d0 47 d9 9b c3 1c 2f da 94 38 67 |.E..d.G..../..8g|
+| fc 9d cb 2a f7 37 7d ae ca f8 f6 d4 ca bd 8d fe |...*.7}.........|
+| 5a fb 12 e4 04 95 ec d7 43 85 d6 5f 2d bb 01 b4 |Z.......C.._-...|
+| 3a 37 de a1 11 d4 46 d6 3d 12 06 44 f6 c7 95 95 |:7....F.=..D....|
+| 18 52 45 0a d6 6f 64 a6 3b 99 92 14 01 7d 83 1d |.RE..od.;....}..|
+| 13 65 5b ce 97 68 00 33 fd b1 16 38 5f a0 41 d5 |.e[..h.3...8_.A.|
+| 4c 30 57 4f 42 94 13 5f ca c8 6b ba 2e f6 a8 16 |L0WOB.._..k.....|
+| c9 59 8b 83 cd ff 6e b2 6a d8 d3 84 98 c5 32 62 |.Y....n.j.....2b|
+| 6c 31 4f f3 b9 40 4f 89 89 36 45 76 8e 58 c4 ed |l1O..@O..6Ev.X..|
+| ec ea 15 0e 52 24 24 c2 2c 35 85 c2 31 2d f9 9e |....R$$.,5..1-..|
+| 91 08 19 3f 3c 5c 5b 78 b3 ec 6f 01 b4 28 b4 ee |...?<\[x..o..(..|
+| ff 07 e5 53 66 17 d9 69 74 fe f8 23 24 e6 8e 97 |...Sf..it..#$...|
+| b5 9d b5 d7 a2 ec 43 eb d9 2b 19 2f f5 45 a5 13 |......C..+./.E..|
+| 3d 53 86 c2 47 fd 02 ca c0 5c d2 84 fb 93 58 b4 |=S..G....\....X.|
+| 39 34 31 50 b6 47 1d 65 d0 4f b5 41 6a 31 c6 6a |941P.G.e.O.Aj1.j|
+| 01 87 e5 23 a1 fe 62 cf 90 60 bf 60 44 e7 b1 31 |...#..b..`.`D..1|
+| b8 07 00 c4 7f 0d 80 9f d2 70 f5 52 2f 8d ad 9e |.........p.R/...|
+| ab e6 dc 66 b9 97 92 f1 4d 0b bb ec 74 ad 11 a6 |...f....M...t...|
+| b4 15 af 2e 7d 81 22 e5 12 57 ec 5b 9b 39 0d 81 |....}."..W.[.9..|
+| 9c ff b1 81 9e fb 35 6a 7d 48 75 49 77 1a b9 b4 |......5j}HuIw...|
+| 2b 08 30 cb 8c 0b a7 95 53 52 4e c5 c3 b7 0d 91 |+.0.....SRN.....|
+| df 15 dd 5d 83 44 34 f4 81 6c fd 05 7a 9b 7c 98 |...].D4..l..z.|.|
+| c9 49 4f 03 73 58 5f 03 f2 a9 da 64 85 eb 9f 0a |.IO.sX_....d....|
+| c7 13 0a 93 c7 66 c7 f3 d6 0f a6 f4 3a 2d 74 08 |.....f......:-t.|
+Plaintext[384]:
+| ae 8e 99 76 d9 61 ff 9b 48 54 54 50 2f 31 2e 31 |...v.a..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 37 |che....0x00,0x07|
+| 20 2d 20 49 44 45 41 2d 43 42 43 2d 53 48 41 20 | - IDEA-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 49 44 45 41 28 31 32 |RSA Enc=IDEA(12|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 84 cb 99 cb 63 c7 43 f1 9d 65 57 e6 |ipt>....c.C..eW.|
+| f9 d7 5b 9b a0 83 d5 c7 07 07 07 07 07 07 07 07 |..[.............|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 7d 45 11 65 2d 37 42 16 78 64 1b 34 d5 d5 9a |.}E.e-7B.xd.4...|
+| 35 e8 2f 09 |5./. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4438 found 0x3425920
+
+dissect_ssl enter frame #72 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d3 1b 64 b4 30 6e 52 69 a1 2c ab 4b e5 73 dc ab |..d.0nRi.,.K.s..|
+| a2 d6 68 81 e9 f3 43 e1 f9 d0 ef be 05 1c b7 2b |..h...C........+|
+Plaintext[32]:
+| 65 12 ec 15 a5 91 75 fd 01 00 49 03 75 0e 63 6c |e.....u...I.u.cl|
+| 16 e4 09 2a 3b 1c bb 02 58 20 7b 2a 6d 6f 01 01 |...*;...X {*mo..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 49 03 75 0e 63 6c 16 e4 09 2a 3b 1c bb 02 58 20 |I.u.cl...*;...X |
+| 7b 2a 6d 6f |{*mo |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #74 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 30 1a d1 69 69 23 95 42 88 f6 84 65 d7 7e cb da |0..ii#.B...e.~..|
+| 6e 01 48 45 9b d2 31 33 20 dd 4f e3 4e e8 87 35 |n.HE..13 .O.N..5|
+Plaintext[32]:
+| 72 1a 1f 8f 05 fb b5 47 01 00 e1 1f 21 eb 91 b4 |r......G....!...|
+| 62 ca b2 10 9b c5 0a 19 10 6b 61 9e c8 b3 01 01 |b........ka.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 1f 21 eb 91 b4 62 ca b2 10 9b c5 0a 19 10 6b |..!...b........k|
+| 61 9e c8 b3 |a... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #79 (first time)
+ssl_session_init: initializing ptr 0x7facc381b170 size 688
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52165 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4439
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #81 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....|
+| 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.|
+| 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.|
+| 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... |
+hash out[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+PRF out[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+key expansion[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...|
+| 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.|
+| df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.|
+| 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.|
+| 0e 35 d8 dc 65 e4 c0 07 |.5..e... |
+hash out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+PRF out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 2d 43 ce 68 92 |-C.h. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.|
+| aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...|
+PRF out[32]:
+| 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.|
+| aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 13 35 a1 ad |..5.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..|
+| 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e|
+PRF out[32]:
+| 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..|
+| 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e|
+Client MAC key[20]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc |..Z. |
+Server MAC key[20]:
+| bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 42 d6 9d 5a |.../......k.B..Z|
+| 3e 5e e2 02 |>^.. |
+Client Write key[8]:
+| 2f e0 62 90 e6 dc 26 9e |/.b...&. |
+Server Write key[8]:
+| 1d f8 a0 57 33 05 9d 5a |...W3..Z |
+Client Write IV[8]:
+| 1a 56 15 98 62 8c 1a c5 |.V..b... |
+Server Write IV[8]:
+| f6 02 d4 da b4 c4 b5 bb |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #83 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309f...
+looking for RSA pre-mastera62989ead4a8a5e58bf2f6a2f811703a3d65165916bb8dda...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....|
+| 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.|
+| 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.|
+| 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... |
+hash out[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+PRF out[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+key expansion[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...|
+| 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.|
+| df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.|
+| 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.|
+| 0e 35 d8 dc 65 e4 c0 07 |.5..e... |
+hash out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+PRF out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| a1 de 58 84 98 |..X.. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......|
+| 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..|
+PRF out[32]:
+| ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......|
+| 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| f9 5d b0 8c 6f |.]..o |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.|
+| 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..|
+PRF out[32]:
+| 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.|
+| 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..|
+Client MAC key[20]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 |.%|. |
+Server MAC key[20]:
+| fb 2f c2 20 9b 0b ed bd 10 38 6e eb 49 5b 72 32 |./. .....8n.I[r2|
+| ce 63 7c 2f |.c|/ |
+Client Write key[8]:
+| ef 0d 2b 13 ce 78 93 43 |..+..x.C |
+Server Write key[8]:
+| 99 f4 36 14 b1 15 c3 94 |..6..... |
+Client Write IV[8]:
+| 1a 56 15 98 62 8c 1a c5 |.V..b... |
+Server Write IV[8]:
+| f6 02 d4 da b4 c4 b5 bb |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9e 2f 76 d1 2f 2f b9 3b dd 2d bf c9 71 ea 86 29 |./v.//.;.-..q..)|
+| a4 2d 4c 2b 75 8c 0e 9e 10 49 1e bb 60 8c 2b 04 |.-L+u....I..`.+.|
+| 1c 71 b9 ff 1f fe 98 86 ea 50 7f 05 8a 01 33 fb |.q.......P....3.|
+Plaintext[48]:
+| 24 51 a1 43 c0 ec a3 1a 14 00 00 0c aa 2a 3d 27 |$Q.C.........*='|
+| 66 61 97 a7 58 37 13 b6 36 ab dc c7 72 bd a3 8a |fa..X7..6...r...|
+| cf fc 79 75 9d 69 52 63 ac 99 01 91 03 03 03 03 |..yu.iRc........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 36 ab dc c7 72 bd a3 8a cf fc 79 75 9d 69 52 63 |6...r.....yu.iRc|
+| ac 99 01 91 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #84 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 02 97 a5 f6 a9 60 b1 e6 25 f6 af 28 a0 00 5e 4e |.....`..%..(..^N|
+| d8 e1 3e 4b 6e bd 2b f4 88 6e 71 34 a9 38 16 b2 |..>Kn.+..nq4.8..|
+| 12 a4 a0 1e 74 46 5c 28 fc 04 9a 2f 88 82 ae 01 |....tF\(.../....|
+Plaintext[48]:
+| f2 99 b1 0e ac c0 45 f1 14 00 00 0c 03 4e 36 17 |......E......N6.|
+| 0b 12 6b f2 c1 ab 9c 9e 4f 12 5a a2 8c a1 e5 c5 |..k.....O.Z.....|
+| ed f5 77 d2 51 0d 10 e1 6f cc dd 29 03 03 03 03 |..w.Q...o..)....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4f 12 5a a2 8c a1 e5 c5 ed f5 77 d2 51 0d 10 e1 |O.Z.......w.Q...|
+| 6f cc dd 29 |o..) |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #85 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| d5 df 46 7f 5e 0e ee 94 fe d8 89 05 b4 fd cd c3 |..F.^...........|
+| c6 b3 a6 60 51 ce c2 42 9f 26 23 d6 c9 6d 9e d2 |...`Q..B.&#..m..|
+| 96 c2 3a 5d f9 68 a4 64 1d 94 cc 0a 9f c7 43 f6 |..:].h.d......C.|
+| b8 e5 f1 cf 3d 14 22 b6 c9 5d 26 02 32 4a 6a 29 |....=."..]&.2Jj)|
+| f4 66 ca 68 35 19 7a 67 fb 94 70 d9 9b 58 67 6c |.f.h5.zg..p..Xgl|
+| 41 dd 04 e0 2d 7f 99 e9 29 37 6f 0d 38 3e b7 83 |A...-...)7o.8>..|
+| 54 eb e9 6e 3a ed 43 25 |T..n:.C% |
+Plaintext[104]:
+| a4 89 ea 43 1b eb ed 86 47 45 54 20 2f 20 48 54 |...C....GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 78 |TP/1.1..Host: ex|
+| 70 2d 64 65 73 2d 63 62 63 2d 73 68 61 2e 6c 6f |p-des-cbc-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 39 0d 0a 0d 0a 93 00 b8 |n.nl:4439.......|
+| 41 d0 ae 0c 83 0a a8 b2 d8 14 3f ac b9 00 71 a9 |A.........?...q.|
+| 11 06 06 06 06 06 06 06 |........ |
+ssl_decrypt_record found padding 6 final len 97
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 93 df f4 91 22 37 94 81 50 48 8a d4 88 08 65 e5 |...."7..PH....e.|
+| ef 4b 2a e1 |.K*. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52165 found (nil)
+association_find: TCP port 4439 found 0x342cfb0
+
+dissect_ssl enter frame #86 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| d0 c7 ac f3 05 4f c3 4e ac 40 c5 57 06 0b 60 bf |.....O.N.@.W..`.|
+| 4c c7 82 3e 85 78 50 02 81 e9 18 cb 92 dd 4e 46 |L..>.xP.......NF|
+| 51 5c a7 59 53 94 59 cd a9 d8 90 fe 3f 7f 0d 7a |Q\.YS.Y.....?..z|
+| ab bf ec a3 e3 20 f7 85 35 04 60 7f 52 42 0d 4a |..... ..5.`.RB.J|
+| 63 51 d2 8d 15 b2 88 8a 9b 7d d7 3d 6d 56 6c 9c |cQ.......}.=mVl.|
+| 75 6b 85 12 61 fc 39 a7 29 d8 fd 77 aa ee e3 4e |uk..a.9.)..w...N|
+| ee a2 1c 19 35 9f 80 c6 a6 fe 08 93 ed ff 89 71 |....5..........q|
+| 13 3c 70 84 5b 44 2c d0 64 a1 26 77 fa 97 0f 49 |.<p.[D,.d.&w...I|
+| 2b 23 c1 f9 21 2f 93 58 23 18 78 1d aa ea b5 ee |+#..!/.X#.x.....|
+| 7e 47 e0 dd b5 85 fe b8 b4 6b 5f 29 9b 32 85 d7 |~G.......k_).2..|
+| da 74 da ff ad 66 20 02 bd 6e a1 11 d1 41 43 35 |.t...f ..n...AC5|
+| 4f 8b 13 65 93 d2 a8 a1 93 1b d2 ed 73 d2 55 13 |O..e........s.U.|
+| e0 52 7d 0b 3b ef e0 0f 52 28 8f a6 23 d5 a3 6d |.R}.;...R(..#..m|
+| e0 30 b4 6e 68 7e 59 02 df 23 b7 69 51 52 66 7e |.0.nh~Y..#.iQRf~|
+| f3 79 d0 98 ab 2d ec 95 3c 20 16 59 51 bb 6b 59 |.y...-..< .YQ.kY|
+| c3 1f e2 a8 ca b6 f3 69 33 48 5e 2b 17 f9 7f e4 |.......i3H^+....|
+| 2b cb 3c 99 25 5c 10 10 44 93 50 e0 4a a4 3b 25 |+.<.%\..D.P.J.;%|
+| 51 ba 88 08 f8 de 64 e4 62 7f 53 e2 b6 5b 30 fc |Q.....d.b.S..[0.|
+| 38 1b 39 f1 2b 48 a7 b2 c1 37 42 f9 1b b2 24 63 |8.9.+H...7B...$c|
+| 60 6c 3c 42 6d 40 c0 30 75 ec 0f 48 c1 bf 0b 76 |`l<Bm@.0u..H...v|
+| c1 41 c2 7a 8b 06 6d 7b 83 a8 dc 8d f0 43 45 40 |.A.z..m{.....CE@|
+| 00 44 e4 74 05 ed c5 96 38 e1 a6 b9 58 04 d4 dd |.D.t....8...X...|
+| da 79 1b 38 70 c7 d3 da 90 ea 19 da 3a c4 78 ee |.y.8p.......:.x.|
+| aa dd 52 5b ce 98 a8 a6 4c bc f8 83 78 57 f5 c1 |..R[....L...xW..|
+Plaintext[384]:
+| fd 3e c1 46 cb 01 dd bd 48 54 54 50 2f 31 2e 31 |.>.F....HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 38 0d |ent-Length: 148.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 38 |che....0x00,0x08|
+| 20 2d 20 45 58 50 2d 44 45 53 2d 43 42 43 2d 53 | - EXP-DES-CBC-S|
+| 48 41 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 |HA SSLv3|
+| 20 4b 78 3d 52 53 41 28 35 31 32 29 20 41 75 3d | Kx=RSA(512) Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 34 30 29 |RSA Enc=DES(40)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 20 65 78 70 6f | Mac=SHA1 expo|
+| 72 74 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |rt<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 02 d9 be 01 69 |l'</script>....i|
+| 26 10 0f 06 e2 8f e2 b9 d9 f0 34 de 06 15 c2 00 |&.........4.....|
+ssl_decrypt_record found padding 0 final len 383
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 bc 22 86 7e 5f f8 3a 84 6a 1b 8b b5 0d 62 c0 |..".~_.:.j....b.|
+| ca c1 7f 40 |...@ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4439 found 0x342cfb0
+
+dissect_ssl enter frame #87 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 21 25 a2 6d 98 e3 24 3b 53 62 1c 7a d0 f7 6d f0 |!%.m..$;Sb.z..m.|
+| 73 1c d5 8c 19 1d 00 1c ef 69 90 e0 6d 24 8f a3 |s........i..m$..|
+Plaintext[32]:
+| 03 a5 dd be a0 be ef 4a 01 00 2a cf 2c 48 90 13 |.......J..*.,H..|
+| 7c ea cd 01 d7 6c dd 23 a8 a3 bd 4d 60 9c 01 01 ||....l.#...M`...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2a cf 2c 48 90 13 7c ea cd 01 d7 6c dd 23 a8 a3 |*.,H..|....l.#..|
+| bd 4d 60 9c |.M`. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #89 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 37 7e 17 a7 c4 96 ff d7 75 c2 29 a6 97 50 2e 9c |7~......u.)..P..|
+| d4 40 b7 6b f2 14 9c 56 51 6e 3e b9 b3 c5 6f 89 |.@.k...VQn>...o.|
+Plaintext[32]:
+| 57 93 1e c1 ad a6 90 6b 01 00 51 df 8b 46 02 5c |W......k..Q..F.\|
+| f3 bd cd 30 44 eb d7 cb c5 ee 66 bb 74 d8 01 01 |...0D.....f.t...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 51 df 8b 46 02 5c f3 bd cd 30 44 eb d7 cb c5 ee |Q..F.\...0D.....|
+| 66 bb 74 d8 |f.t. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #94 (first time)
+ssl_session_init: initializing ptr 0x7facc381d630 size 688
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50147 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4440
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #96 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....|
+| 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.|
+| 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f|
+| f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... |
+hash out[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+PRF out[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+key expansion[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+Client MAC key[20]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f |^C.o |
+Server MAC key[20]:
+| bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 f2 32 56 fb |..p.._~9..%`.2V.|
+| 9f a4 9a 8b |.... |
+Client Write key[8]:
+| 9f 58 38 0d 59 c0 86 12 |.X8.Y... |
+Server Write key[8]:
+| 0c 82 76 fe ec 53 37 c9 |..v..S7. |
+Client Write IV[8]:
+| c6 61 03 48 fd 2a ce 40 |.a.H.*.@ |
+Server Write IV[8]:
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #98 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94...
+looking for RSA pre-master113e309073f08d54ca50f560cbcc67a69298e5c229d6ee4c...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....|
+| 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.|
+| 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f|
+| f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... |
+hash out[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+PRF out[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+key expansion[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+Client MAC key[20]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 |.Y.. |
+Server MAC key[20]:
+| 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 3d 0d 36 ac |..nh.=~..,..=.6.|
+| fe 16 83 d5 |.... |
+Client Write key[8]:
+| 82 74 79 3f ec b5 47 7d |.ty?..G} |
+Server Write key[8]:
+| 67 8a 93 62 1b ca fd 45 |g..b...E |
+Client Write IV[8]:
+| 8c 8a af b4 c2 61 12 81 |.....a.. |
+Server Write IV[8]:
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4d 49 26 30 9f 76 b9 65 f2 de d9 fe b2 a4 a1 ec |MI&0.v.e........|
+| d4 ca 74 ce db 15 60 77 e5 c5 f8 2f 93 57 ae d4 |..t...`w.../.W..|
+| 12 d6 53 d0 40 e5 8f 5f 3b b0 2e 0c 57 b1 ef 17 |..S.@.._;...W...|
+Plaintext[48]:
+| b2 2d be 6a 6c 68 e3 67 14 00 00 0c 32 36 10 27 |.-.jlh.g....26.'|
+| 45 c2 35 2e e7 fd 99 ef e6 41 49 34 3a c8 68 cc |E.5......AI4:.h.|
+| 39 b6 bc be 20 25 c7 89 e5 7e 74 0a 03 03 03 03 |9... %...~t.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e6 41 49 34 3a c8 68 cc 39 b6 bc be 20 25 c7 89 |.AI4:.h.9... %..|
+| e5 7e 74 0a |.~t. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #99 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c3 ea fd 82 d3 d6 6c e2 00 bb c3 84 1d 48 24 0a |......l......H$.|
+| 6f 2d 02 f4 77 5b 43 ac ab 04 7c 54 bd 2b 81 de |o-..w[C...|T.+..|
+| 76 7c c9 56 a0 35 d1 f6 ff ec ca 85 8c ea 1e e5 |v|.V.5..........|
+Plaintext[48]:
+| dd 05 d3 72 a2 14 09 14 14 00 00 0c ed 76 03 3a |...r.........v.:|
+| a3 69 18 52 fb dc 1b ef 0d 9c 8c bd 6b 84 4f 23 |.i.R........k.O#|
+| 8a c5 cd a6 59 9b 86 57 28 90 0b 02 03 03 03 03 |....Y..W(.......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0d 9c 8c bd 6b 84 4f 23 8a c5 cd a6 59 9b 86 57 |....k.O#....Y..W|
+| 28 90 0b 02 |(... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #100 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 11 db b3 52 2e ad 38 13 bc 11 5d f4 29 5a 5c 06 |...R..8...].)Z\.|
+| a0 a9 08 da 2c 4f d2 19 77 1d 33 f4 75 2d 11 78 |....,O..w.3.u-.x|
+| e1 4f 11 0c a2 fc 38 1d 23 e1 9e af 16 21 37 58 |.O....8.#....!7X|
+| d5 90 60 4b 63 b0 1f 98 07 99 9f 00 29 5e 99 9e |..`Kc.......)^..|
+| b2 e0 1e 6c b5 e1 75 6d c1 0a ed 54 28 a4 c2 ef |...l..um...T(...|
+| 44 ea 12 60 ee 77 fc f8 11 81 07 33 68 6c bf 3b |D..`.w.....3hl.;|
+Plaintext[96]:
+| c5 34 71 10 4f 4f 9c 44 47 45 54 20 2f 20 48 54 |.4q.OO.DGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 30 0d 0a 0d 0a 6e 7d 5e 16 f6 79 c0 |:4440....n}^..y.|
+| ff 31 f9 b3 27 95 a0 f5 10 be bc fe 4b 02 02 02 |.1..'.......K...|
+ssl_decrypt_record found padding 2 final len 93
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7e 6f 9d 97 cf 0d 1d 4a d2 5e f0 23 ec 73 04 f5 |~o.....J.^.#.s..|
+| b8 a0 aa 89 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50147 found (nil)
+association_find: TCP port 4440 found 0x342d040
+
+dissect_ssl enter frame #101 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 20 7a e5 fb 30 5d bf 30 4b 54 b2 d8 7d db db 30 | z..0].0KT..}..0|
+| 49 22 22 28 c7 f5 8e a4 ad 6c b4 5d 0b 69 9f 7c |I""(.....l.].i.||
+| 5a 6a 56 1e 7e 3b 60 20 1c dd 27 e0 14 59 0c 5e |ZjV.~;` ..'..Y.^|
+| e5 c0 07 79 a6 4e a0 35 c1 a9 d5 d3 0c c8 f3 c1 |...y.N.5........|
+| ef 1c 07 f0 36 79 f3 0b 79 ff 7e d3 29 96 85 ac |....6y..y.~.)...|
+| a9 90 50 95 d4 9d 52 ab dc 9a bd c3 4b 7c 6b 55 |..P...R.....K|kU|
+| b2 44 00 91 0a d1 6c 69 d8 c8 1f 49 78 5a f8 b3 |.D....li...IxZ..|
+| 9e 9e 61 e4 86 b5 92 33 7f 14 83 95 41 93 d2 05 |..a....3....A...|
+| 4b a1 0a 05 35 38 5a 37 5d f4 c0 0e b0 1c d0 32 |K...58Z7]......2|
+| e2 9d 10 6d ff c3 8b af c5 18 3f d4 45 6a a8 84 |...m......?.Ej..|
+| 1e a9 ed c8 d1 1f 2b 56 a8 77 e7 75 62 9d 7f ee |......+V.w.ub...|
+| e7 cd 70 2e 92 15 f1 e2 87 b4 bc 13 df 81 fd 30 |..p............0|
+| 4c 02 41 6c 67 e8 be 2f 68 11 de e9 f1 3c 5e fb |L.Alg../h....<^.|
+| 3f ab 3a d0 87 1e b3 39 cb af 07 49 8a 9a 21 04 |?.:....9...I..!.|
+| 6c 23 45 94 a4 b9 ef 31 7b 4c c9 16 0c 6b 4d ad |l#E....1{L...kM.|
+| 3e 9a 08 cc 69 3f aa 05 35 d5 d0 d7 f7 6e 4a 60 |>...i?..5....nJ`|
+| f3 27 67 3d 96 3c 40 42 d1 94 38 00 09 75 47 73 |.'g=.<@B..8..uGs|
+| 14 74 3f 0f bb 60 3f e5 54 69 e9 2c 0d 27 12 fc |.t?..`?.Ti.,.'..|
+| 84 73 65 67 b9 c0 f3 72 d3 c8 70 db 14 8c 77 14 |.seg...r..p...w.|
+| b9 a4 62 9d 9a fb 3f 56 0e 96 6f ff 61 be ff 80 |..b...?V..o.a...|
+| 95 47 c5 a3 9c 5a 73 3c 27 c6 6f f7 15 bd 2f 12 |.G...Zs<'.o.../.|
+| 3d 26 23 42 b5 35 e5 1a 7e 85 21 ea b3 45 2f a6 |=&#B.5..~.!..E/.|
+| 73 06 d6 0d 28 33 82 13 de 53 f8 61 13 09 9f e0 |s...(3...S.a....|
+| 85 8f b7 73 56 e2 ba f4 97 31 45 d9 a2 b8 a6 0f |...sV....1E.....|
+Plaintext[384]:
+| 21 d5 ef cf b8 85 d2 01 48 54 54 50 2f 31 2e 31 |!.......HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 39 |che....0x00,0x09|
+| 20 2d 20 44 45 53 2d 43 42 43 2d 53 48 41 20 20 | - DES-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 67 bb 26 a7 53 68 cb 4d d9 b0 61 14 |ipt>g.&.Sh.M..a.|
+| 08 13 d8 79 3a 36 a2 0a 07 07 07 07 07 07 07 07 |...y:6..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 fa 92 45 d4 13 d8 bb 5e 86 a6 3e 2b ab 10 05 |...E....^..>+...|
+| 66 af 62 d4 |f.b. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4440 found 0x342d040
+
+dissect_ssl enter frame #102 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ca cd 98 23 77 ce f4 50 c2 57 19 9c 6a 94 96 83 |...#w..P.W..j...|
+| da e8 13 d1 6c be f0 4d e4 7e d9 86 d3 d0 00 5b |....l..M.~.....[|
+Plaintext[32]:
+| 6e ab 83 3a 0c 6a 54 72 01 00 7b 75 cf dc 51 f7 |n..:.jTr..{u..Q.|
+| 5f 4a de 1b 15 82 02 fd ce 0e e2 86 e7 eb 01 01 |_J..............|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7b 75 cf dc 51 f7 5f 4a de 1b 15 82 02 fd ce 0e |{u..Q._J........|
+| e2 86 e7 eb |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #104 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d4 57 0a 93 7f ed 1e ca 54 06 8d 5c de 13 74 43 |.W......T..\..tC|
+| 6f 98 56 8f 55 8e 7c cb a0 80 21 38 ce ce f8 b9 |o.V.U.|...!8....|
+Plaintext[32]:
+| f2 89 20 50 3a 5d a2 8a 01 00 6c 47 5d 5a 84 c2 |.. P:]....lG]Z..|
+| 11 a8 4e 93 b7 2f 0e 46 2c 9d 58 91 e2 db 01 01 |..N../.F,.X.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 47 5d 5a 84 c2 11 a8 4e 93 b7 2f 0e 46 2c 9d |lG]Z....N../.F,.|
+| 58 91 e2 db |X... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #109 (first time)
+ssl_session_init: initializing ptr 0x7facc381fbf0 size 688
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55756 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4441
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #111 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..|
+| c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.|
+| 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(|
+| 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K |
+hash out[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+PRF out[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+key expansion[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+Client MAC key[20]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be |..3. |
+Server MAC key[20]:
+| f5 77 31 d2 e3 59 16 50 ad 49 44 c2 d7 ff bf 83 |.w1..Y.P.ID.....|
+| 23 11 02 07 |#... |
+Client Write key[24]:
+| 56 80 49 52 75 8a b0 66 66 5b d7 9e 3a 1a 20 6d |V.IRu..ff[..:. m|
+| 71 5b 66 e7 ed 85 85 05 |q[f..... |
+Server Write key[24]:
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 |q.r.N..3 |
+Client Write IV[8]:
+| 8d 60 74 7d c3 94 cd 02 |.`t}.... |
+Server Write IV[8]:
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #113 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ec...
+looking for RSA pre-master002f09b09d0de0dba351fcefb17adf42995c476d0a2bd37f...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..|
+| c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.|
+| 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(|
+| 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K |
+hash out[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+PRF out[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+key expansion[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+Client MAC key[20]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a |.... |
+Server MAC key[20]:
+| 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 98 44 b6 06 |.!........,..D..|
+| b2 54 66 cb |.Tf. |
+Client Write key[24]:
+| 5f 49 2c 8d 04 b9 bf c1 43 98 17 73 f1 65 a7 86 |_I,.....C..s.e..|
+| dc 5c ad 8d 68 6c a4 de |.\..hl.. |
+Server Write key[24]:
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 |.*...+. |
+Client Write IV[8]:
+| 1b d1 5a 49 1c 45 59 6b |..ZI.EYk |
+Server Write IV[8]:
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 64 d7 01 47 6d 68 ac be 80 ef 6a f6 0b 3e 38 2c |d..Gmh....j..>8,|
+| 2d 5c d7 1d f4 4d cc e3 09 c3 4c f6 5b fe d0 fd |-\...M....L.[...|
+| 9d e9 49 c3 a0 80 56 6c c4 b4 b8 a0 25 e3 00 e0 |..I...Vl....%...|
+Plaintext[48]:
+| 53 a9 17 8a a6 e5 f7 a2 14 00 00 0c 0b 5c 4f c2 |S............\O.|
+| 41 06 37 83 4a 3b 8e af cd 23 af 7a 24 a1 0e 71 |A.7.J;...#.z$..q|
+| 9b d0 6a 0f 9a 5e a3 5c 8c 27 ff 35 03 03 03 03 |..j..^.\.'.5....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 23 af 7a 24 a1 0e 71 9b d0 6a 0f 9a 5e a3 5c |.#.z$..q..j..^.\|
+| 8c 27 ff 35 |.'.5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #114 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 47 5b eb de 90 8a 3d 10 98 da 79 32 f8 f7 fd 75 |G[....=...y2...u|
+| e9 03 0a 06 8d f6 f9 84 c8 ad b5 25 42 4f 10 42 |...........%BO.B|
+| 30 56 21 8e a6 18 bb c9 ef 7d 32 87 c6 e9 c4 b5 |0V!......}2.....|
+Plaintext[48]:
+| c0 f9 b0 90 c3 2d ad 4a 14 00 00 0c 97 aa 11 89 |.....-.J........|
+| 33 79 e3 13 5d 72 87 f0 76 41 81 af 18 ed 8d cd |3y..]r..vA......|
+| 09 9d ac dc 72 fa fc bb 47 13 bf 45 03 03 03 03 |....r...G..E....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 76 41 81 af 18 ed 8d cd 09 9d ac dc 72 fa fc bb |vA..........r...|
+| 47 13 bf 45 |G..E |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #115 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 73 db bd d6 64 e3 d7 0a 0c 4a fb b6 24 c2 2a d4 |s...d....J..$.*.|
+| ca 9a ec 15 0b b0 47 20 2d 76 60 b1 dd 66 45 5c |......G -v`..fE\|
+| 58 f0 07 b7 47 3a 6f a2 45 90 4d fd 30 99 3f 32 |X...G:o.E.M.0.?2|
+| 43 84 88 47 59 57 2e af 6b c4 0f d9 52 18 5e e7 |C..GYW..k...R.^.|
+| ed 4b 97 52 f9 b4 51 4f 8f 3d 5a 68 9d 76 b1 76 |.K.R..QO.=Zh.v.v|
+| 66 16 b4 1e d1 a3 a9 c7 9f 14 33 4e 38 cd c8 6d |f.........3N8..m|
+Plaintext[96]:
+| fd 0c 83 39 38 9b 82 b9 47 45 54 20 2f 20 48 54 |...98...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 31 0d 0a 0d 0a 7d 31 90 11 1e d5 |l:4441....}1....|
+| a6 6e 98 a1 8d 51 2c 1f 9f 47 cd a1 6d d5 01 01 |.n...Q,..G..m...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| af 05 67 d6 7c 43 c7 1b 65 34 9d 67 d4 5e 20 eb |..g.|C..e4.g.^ .|
+| e7 e6 ac 49 |...I |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55756 found (nil)
+association_find: TCP port 4441 found 0x342d0d0
+
+dissect_ssl enter frame #116 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 81 25 d4 59 0f 03 bc 3c ad 17 b0 01 a8 10 56 03 |.%.Y...<......V.|
+| 1e 2c 32 67 45 34 8b f8 66 8c 52 52 51 ed 13 b0 |.,2gE4..f.RRQ...|
+| 23 bc 36 78 3e e4 2d 0d a1 23 be 97 6b 19 6b 14 |#.6x>.-..#..k.k.|
+| 58 da d3 0f 12 17 aa 56 50 c8 aa 5b 7c 6f 2c 7f |X......VP..[|o,.|
+| cd 77 2a d5 a6 93 9e 1e 8f 1a cb 07 67 0d 8b 52 |.w*.........g..R|
+| 90 2a 52 c6 c2 d1 67 80 6a 1d 21 89 ec f1 3e ad |.*R...g.j.!...>.|
+| d8 33 fa 93 a2 b0 de b2 7d af 36 19 a3 6a 3b e5 |.3......}.6..j;.|
+| 51 d9 df 6c 7d 08 eb 92 a5 a9 ca ac 59 aa e4 59 |Q..l}.......Y..Y|
+| 15 63 e7 7f f4 79 b8 59 a5 e8 f6 3c cd c8 1c 60 |.c...y.Y...<...`|
+| 7d 0e ce b0 75 6b 5c cb d3 36 20 ea 0b 6c 6f 1c |}...uk\..6 ..lo.|
+| 63 21 7b 1c 2c 3c 21 c4 da 10 5b c5 eb 83 5f ae |c!{.,<!...[..._.|
+| 89 b7 42 89 0a 2e d5 4b 7b cf 76 af 25 0f c8 7e |..B....K{.v.%..~|
+| c6 ea cc 94 d2 ca d9 00 d4 69 95 f1 25 94 04 76 |.........i..%..v|
+| 05 cd a5 80 9e 59 4d ea 84 ed 1b 63 bc ec 9c e8 |.....YM....c....|
+| 36 30 ea f6 d9 83 8b 9d f2 48 f7 95 9c 2a 76 56 |60.......H...*vV|
+| 6f 7a 32 2e 9b 4f 0e 27 05 2e ad d9 74 d6 29 25 |oz2..O.'....t.)%|
+| 47 71 35 bb 85 eb 84 dc 66 6a c3 81 41 c6 1e 17 |Gq5.....fj..A...|
+| 68 0e 38 3e 39 d1 ea 8c aa 09 8b 09 c4 b8 49 cd |h.8>9.........I.|
+| 28 08 1f 96 61 38 05 e9 a1 06 9c 46 61 6b 08 00 |(...a8.....Fak..|
+| f1 e1 4d 50 e9 7f 9e 27 c4 46 06 3e 0c 7e ff 07 |..MP...'.F.>.~..|
+| 1f f7 c4 4c 24 5f 5f 94 0c 97 de 1a 66 f4 09 9f |...L$__.....f...|
+| 75 14 17 cb a4 3e 61 35 ec e7 8b 63 61 4e bc 96 |u....>a5...caN..|
+| 8e d3 d1 8f 8d 19 f8 f4 cf 7b ec 7a d6 f7 02 45 |.........{.z...E|
+| 1a bc 66 28 6e 45 5c 07 fe dd ee 3a d8 06 8a 0b |..f(nE\....:....|
+Plaintext[384]:
+| d7 87 da 2c b6 ac a8 e6 48 54 54 50 2f 31 2e 31 |...,....HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 41 |che....0x00,0x0A|
+| 20 2d 20 44 45 53 2d 43 42 43 33 2d 53 48 41 20 | - DES-CBC3-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 1c 84 af 4f ea 91 26 ea 0b fb 4c c3 |ipt>...O..&...L.|
+| 9b c9 15 8e 1a 02 2b 6d 07 07 07 07 07 07 07 07 |......+m........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 5d 7a ca 0d 41 2c 16 d2 05 1c 14 d2 fe b5 ff |.]z..A,.........|
+| c9 df da 04 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4441 found 0x342d0d0
+
+dissect_ssl enter frame #117 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2b 1b f6 bf 99 db 13 91 ea a9 e6 70 92 3e 80 d2 |+..........p.>..|
+| 29 be 4e 47 2f 5c bd 57 73 50 c5 af 0c 6d 97 0e |).NG/\.WsP...m..|
+Plaintext[32]:
+| 0e a7 12 62 90 a2 6a c8 01 00 ee 80 00 9b 9c 51 |...b..j........Q|
+| ed a5 c3 5b 34 71 45 b2 b1 9e a2 cf d8 91 01 01 |...[4qE.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 80 00 9b 9c 51 ed a5 c3 5b 34 71 45 b2 b1 9e |.....Q...[4qE...|
+| a2 cf d8 91 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #119 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 58 4f 72 ed 2c 1f 62 60 69 57 1c ad b9 72 0b 3c |XOr.,.b`iW...r.<|
+| 6e 15 79 a3 b9 85 e2 0e 0d 6c 8a a3 aa e7 07 3c |n.y......l.....<|
+Plaintext[32]:
+| e1 ef 85 ff bb 67 17 3e 01 00 74 b7 63 97 30 e2 |.....g.>..t.c.0.|
+| 31 6a e0 09 a2 b4 95 b8 d0 e5 aa 60 ef 72 01 01 |1j.........`.r..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 b7 63 97 30 e2 31 6a e0 09 a2 b4 95 b8 d0 e5 |t.c.0.1j........|
+| aa 60 ef 72 |.`.r |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #124 (first time)
+ssl_session_init: initializing ptr 0x7facc3822170 size 688
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47475 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4443
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #126 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..|
+| 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.|
+| 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....|
+| 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ |
+hash out[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+PRF out[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+key expansion[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+Client MAC key[20]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d |/.Dm |
+Server MAC key[20]:
+| 3a 09 14 d8 cc 41 5b 87 84 18 51 0d fa 6b 1a c1 |:....A[...Q..k..|
+| d2 dd ee 99 |.... |
+Client Write key[8]:
+| ae 7e 55 f1 46 cc 7f 2f |.~U.F../ |
+Server Write key[8]:
+| a6 48 c3 fe e6 7c 70 ed |.H...|p. |
+Client Write IV[8]:
+| 2e 80 8f 37 fc 81 8c 65 |...7...e |
+Server Write IV[8]:
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #128 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea04096...
+looking for RSA pre-master0080b8603544edfde42c437eb40569d8924b670069534998...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..|
+| 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.|
+| 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....|
+| 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ |
+hash out[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+PRF out[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+key expansion[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+Client MAC key[20]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 |D... |
+Server MAC key[20]:
+| a9 07 e8 e8 db d7 87 10 a5 c3 72 08 28 4d b0 4c |..........r.(M.L|
+| 65 40 0d a2 |e@.. |
+Client Write key[8]:
+| c0 9e 03 fc 60 02 8f 26 |....`..& |
+Server Write key[8]:
+| 3c 51 cd a9 2f 0d 6f 76 |<Q../.ov |
+Client Write IV[8]:
+| 1d bb e0 92 17 48 aa 0e |.....H.. |
+Server Write IV[8]:
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e7 7a 13 54 dd f2 f6 fa 66 95 fa 78 b6 35 fb 7b |.z.T....f..x.5.{|
+| c8 0b 02 69 09 55 e2 de d9 dc 78 3b b1 d4 73 fd |...i.U....x;..s.|
+| 1b 39 10 ec 70 c0 07 7d fa 65 64 f7 cd e3 32 1b |.9..p..}.ed...2.|
+Plaintext[48]:
+| f8 ba 66 a0 c5 f2 aa 27 14 00 00 0c a1 94 7b 7c |..f....'......{||
+| 50 b6 db d7 23 b3 d5 e6 5d 50 13 15 c2 c6 a0 13 |P...#...]P......|
+| 1f f1 ad 62 02 63 1c 4d 62 69 01 48 03 03 03 03 |...b.c.Mbi.H....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 50 13 15 c2 c6 a0 13 1f f1 ad 62 02 63 1c 4d |]P.........b.c.M|
+| 62 69 01 48 |bi.H |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #129 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d5 f9 70 e3 57 3f 97 6a c0 84 4c 1d 32 e1 71 47 |..p.W?.j..L.2.qG|
+| 38 1d 6e 43 a1 89 0f 85 51 f6 62 d1 55 ed a8 0e |8.nC....Q.b.U...|
+| a4 6d d0 50 54 d0 05 86 5e e2 a8 78 61 33 50 99 |.m.PT...^..xa3P.|
+Plaintext[48]:
+| 29 0f c6 15 ba 5a a0 aa 14 00 00 0c 6a 86 2b bf |)....Z......j.+.|
+| a5 7a f7 b5 15 a8 22 95 cd c2 cb fd 3b 7d 57 ff |.z....".....;}W.|
+| 45 f0 43 46 5c 0a 12 32 a9 05 a7 b6 03 03 03 03 |E.CF\..2........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd c2 cb fd 3b 7d 57 ff 45 f0 43 46 5c 0a 12 32 |....;}W.E.CF\..2|
+| a9 05 a7 b6 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #130 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 95 c6 8f 5c cb a6 bb c8 e4 9a a7 a1 be a7 99 46 |...\...........F|
+| de 1c 4c e0 39 cf 77 4d e7 ed ed 6f 3c a1 48 b7 |..L.9.wM...o<.H.|
+| bd d8 50 3c 3e 5d a0 b0 26 04 e2 da c4 d5 50 95 |..P<>]..&.....P.|
+| 83 f2 ba 23 37 68 7d 72 7f 7e d0 48 a8 3f 6b 0e |...#7h}r.~.H.?k.|
+| 12 f9 57 e4 ad 57 0f 59 02 a9 d5 a2 99 f5 c8 1c |..W..W.Y........|
+| 90 84 2c ff 97 be 29 57 1d 16 ee 21 e2 f3 1f ae |..,...)W...!....|
+| f5 25 0f 1a df 9b 85 ca |.%...... |
+Plaintext[104]:
+| 0f b6 f3 e9 59 cb de b5 47 45 54 20 2f 20 48 54 |....Y...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 2d 73 68 |h-dss-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 33 0d 0a 0d |steyn.nl:4443...|
+| 0a 30 b3 29 3d e2 4e 08 46 ce e8 51 6a 61 77 c2 |.0.)=.N.F..Qjaw.|
+| bc 6a b4 9b 16 02 02 02 |.j...... |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 38 8e cb 90 10 df af 98 1b 8d 0c 1c 56 f1 5a f0 |8...........V.Z.|
+| 04 a4 50 46 |..PF |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47475 found (nil)
+association_find: TCP port 4443 found 0x342da70
+
+dissect_ssl enter frame #131 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 33 5f 3a 79 09 d7 bd 7b 84 37 ea 25 af ee e3 ad |3_:y...{.7.%....|
+| ad bf 90 af 9c 41 19 76 ba 56 71 12 3d 40 01 8f |.....A.v.Vq.=@..|
+| 79 b0 66 a4 21 6e 40 d1 d9 22 12 61 72 43 66 f2 |y.f.!n@..".arCf.|
+| c1 d2 40 ba 47 ce bb 41 bc cb 61 d5 fc ed a9 81 |..@.G..A..a.....|
+| 8c 02 fb e2 1a 21 8a 04 25 31 d4 d8 b4 38 8c ae |.....!..%1...8..|
+| 28 47 dd 21 9b a6 02 ed 43 9a 3e 47 a4 31 34 2d |(G.!....C.>G.14-|
+| be 83 2b 8e f5 86 f8 fb d6 30 0e 17 31 c2 83 a4 |..+......0..1...|
+| 44 92 8b 7b d6 0a bf 07 bc 64 70 1b 51 0b 7f fa |D..{.....dp.Q...|
+| 5d 9a da 3a 90 54 87 e8 d2 7d 4f 03 5b 1b d3 01 |]..:.T...}O.[...|
+| fe e9 ea 78 37 39 c0 3a 97 a8 c3 78 75 46 66 a1 |...x79.:...xuFf.|
+| eb b9 b7 52 9d 51 b3 b0 5d 1c 9b 10 45 41 c3 33 |...R.Q..]...EA.3|
+| 64 2e 0b 3a 80 f1 ca db be eb 96 e2 b7 d2 d2 52 |d..:...........R|
+| 52 ba bb df 71 54 b7 22 af ba 05 6f b5 76 5d dc |R...qT."...o.v].|
+| c5 f6 73 fc ea cf 02 c6 7a 7d c1 4e 3f 50 72 83 |..s.....z}.N?Pr.|
+| c4 ca 31 87 50 ae d7 ac c5 9f 28 9a 5d f8 76 a4 |..1.P.....(.].v.|
+| c6 b2 f4 75 a2 a9 d1 f0 7f 6c fe 88 90 0a 90 61 |...u.....l.....a|
+| 7e 44 96 df bd de 2d 12 cd 35 b1 90 b6 20 c3 69 |~D....-..5... .i|
+| f8 81 19 80 7b 95 4b f7 a0 a1 f6 bd 45 23 ef 34 |....{.K.....E#.4|
+| d8 ed 6f 7e 1c 3d b4 22 98 37 d1 0a 53 e2 e5 22 |..o~.=.".7..S.."|
+| 9e 15 02 ad a0 80 dd 75 6a aa 0a ff 45 fd f0 e4 |.......uj...E...|
+| 43 7c b8 21 5f a1 90 25 d3 d5 9e 94 07 e4 fe 59 |C|.!_..%.......Y|
+| fd 2d b7 48 42 8e 69 cb 94 f7 28 fc 19 51 ff 68 |.-.HB.i...(..Q.h|
+| b8 8d 3f ab b7 1f 8c 56 d5 ee ed 51 e6 9c 88 b9 |..?....V...Q....|
+| 85 62 9f 03 f5 7c 4b 96 97 33 03 e6 16 3c e7 1e |.b...|K..3...<..|
+Plaintext[384]:
+| b8 c5 19 0e 41 d7 91 e7 48 54 54 50 2f 31 2e 31 |....A...HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 32 |che....0x00,0x12|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |DSS Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 20 9f 38 33 9a a2 e3 42 08 af 1a 6f |ipt> .83...B...o|
+| cb ac 11 16 62 65 d9 77 07 07 07 07 07 07 07 07 |....be.w........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 58 1b 47 bf a2 88 97 eb 49 d3 35 9c fc a1 4d 5c |X.G.....I.5...M\|
+| 87 07 38 48 |..8H |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4443 found 0x342da70
+
+dissect_ssl enter frame #132 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 6c 54 ca a5 84 57 b5 d7 ea 2e 7a 6e 19 22 f0 6a |lT...W....zn.".j|
+| 3c 55 3f 0a 23 81 3b 04 3e ef cc b8 8f 3f b9 71 |<U?.#.;.>....?.q|
+Plaintext[32]:
+| 7c cf ac eb eb 9f a8 1c 01 00 a8 98 04 64 39 d7 ||............d9.|
+| 7a e9 a5 36 a7 56 6a 02 01 53 eb 29 76 e9 01 01 |z..6.Vj..S.)v...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a8 98 04 64 39 d7 7a e9 a5 36 a7 56 6a 02 01 53 |...d9.z..6.Vj..S|
+| eb 29 76 e9 |.)v. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #134 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 61 19 65 f7 6a d4 16 67 e4 22 76 29 6d 87 2b 0a |a.e.j..g."v)m.+.|
+| d3 55 54 ad c6 3f 72 9d 94 79 af 92 66 42 d5 75 |.UT..?r..y..fB.u|
+Plaintext[32]:
+| d8 42 0a 0d 6e b2 ea ce 01 00 e1 70 ad 00 81 93 |.B..n......p....|
+| 0c ce bb b9 3e ad 2c f7 25 4f 35 d4 84 a4 01 01 |....>.,.%O5.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 70 ad 00 81 93 0c ce bb b9 3e ad 2c f7 25 4f |.p........>.,.%O|
+| 35 d4 84 a4 |5... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #139 (first time)
+ssl_session_init: initializing ptr 0x7facc3824670 size 688
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60402 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4444
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #141 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....|
+| 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.|
+| 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!|
+| f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. |
+hash out[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+PRF out[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+key expansion[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+Client MAC key[20]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c |.\.l |
+Server MAC key[20]:
+| 37 db 48 db cb d1 5f 66 89 d3 97 bc 23 14 07 f3 |7.H..._f....#...|
+| 3f 2a 98 f3 |?*.. |
+Client Write key[24]:
+| 6e fa e9 c3 88 b2 28 69 d0 1f 35 35 20 24 f3 c5 |n.....(i..55 $..|
+| 7f 7e a4 55 ef ec 5c c2 |.~.U..\. |
+Server Write key[24]:
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 |A....... |
+Client Write IV[8]:
+| fd 5a 18 31 d7 61 26 d4 |.Z.1.a&. |
+Server Write IV[8]:
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #143 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763...
+looking for RSA pre-master00806e8987be63f656f700ba3e954714c9a88a06f035968f...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....|
+| 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.|
+| 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!|
+| f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. |
+hash out[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+PRF out[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+key expansion[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+Client MAC key[20]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 |.... |
+Server MAC key[20]:
+| ae 02 2a 8b 57 bb 77 cb 20 36 42 86 bc ec cc f7 |..*.W.w. 6B.....|
+| 05 70 51 21 |.pQ! |
+Client Write key[24]:
+| 4d 74 91 6b 6c 13 a3 36 bc c2 a1 42 0e 76 c1 62 |Mt.kl..6...B.v.b|
+| 95 0e b9 f3 36 f2 52 26 |....6.R& |
+Server Write key[24]:
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b |.r...... |
+Client Write IV[8]:
+| 62 d5 87 44 e9 69 99 06 |b..D.i.. |
+Server Write IV[8]:
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3d b4 f8 fb 08 61 48 c4 35 e1 28 af e7 ea 2a a9 |=....aH.5.(...*.|
+| 4e 3a e1 25 ff 7b 89 56 76 de b6 5b f1 e5 1c 7f |N:.%.{.Vv..[....|
+| 37 eb 87 25 4b d8 3c 74 5f 61 5d 07 03 e2 12 88 |7..%K.<t_a].....|
+Plaintext[48]:
+| bc 0a 68 46 4e 95 79 6d 14 00 00 0c d4 ea 39 85 |..hFN.ym......9.|
+| 6c 0f 5b 03 09 83 4e 1a 54 f7 d5 f7 27 e1 ad be |l.[...N.T...'...|
+| cd be 19 cd b8 1d 31 71 80 66 94 5d 03 03 03 03 |......1q.f.]....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 54 f7 d5 f7 27 e1 ad be cd be 19 cd b8 1d 31 71 |T...'.........1q|
+| 80 66 94 5d |.f.] |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #144 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e2 3d 49 9d 19 74 2f a1 66 a6 e3 df 85 95 eb c0 |.=I..t/.f.......|
+| ba b0 f4 81 8c 0a 2f 2c 69 4e 3a cd 8c 5b 22 88 |....../,iN:..[".|
+| 1e 35 c0 37 ac 07 7b 51 42 8f 9e f9 01 50 8c 71 |.5.7..{QB....P.q|
+Plaintext[48]:
+| eb 1f 06 e1 b5 08 4f ed 14 00 00 0c f0 02 47 0d |......O.......G.|
+| bf 59 da 5d c1 f2 ee 5d 6f 42 c4 e2 0d 73 c0 e6 |.Y.]...]oB...s..|
+| 93 45 ee 70 db f0 76 40 c6 b6 d7 04 03 03 03 03 |.E.p..v@........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6f 42 c4 e2 0d 73 c0 e6 93 45 ee 70 db f0 76 40 |oB...s...E.p..v@|
+| c6 b6 d7 04 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #145 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| f1 70 aa 76 6d 54 da 5f 3b df 55 c0 62 fe f4 4d |.p.vmT._;.U.b..M|
+| b0 f8 d9 f8 5f 82 ba dc 37 b6 db f2 6b 9e 29 44 |...._...7...k.)D|
+| b2 d4 04 04 73 c5 c7 5d d5 51 a9 d6 78 8b f8 b6 |....s..].Q..x...|
+| 80 5f f8 2f ff 71 1f ff 9a 79 c9 1f eb 32 f8 7f |._./.q...y...2..|
+| d8 85 f4 6f 0e 69 47 97 74 2f 72 9c 05 57 f9 b5 |...o.iG.t/r..W..|
+| e8 c7 ba 1e 8b 98 cc 24 0d 3b 2a 06 33 a2 de 67 |.......$.;*.3..g|
+| d8 5b 54 02 6d 50 2c 10 |.[T.mP,. |
+Plaintext[104]:
+| 00 07 22 1f 29 76 f6 80 47 45 54 20 2f 20 48 54 |..".)v..GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 33 2d 73 |h-dss-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 34 0d 0a |nsteyn.nl:4444..|
+| 0d 0a 96 9f 44 31 43 3b 0d 29 39 e8 f9 eb 8a d5 |....D1C;.)9.....|
+| d0 4e 5c 4b af db 01 01 |.N\K.... |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 76 76 10 c4 72 f9 ee 57 03 a4 f7 5a f8 07 8f |yvv..r..W...Z...|
+| 9d 11 4b ae |..K. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60402 found (nil)
+association_find: TCP port 4444 found 0x342db00
+
+dissect_ssl enter frame #146 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 48 80 aa 19 51 37 56 3a fe 0c ac c5 6a 89 88 41 |H...Q7V:....j..A|
+| 83 d7 41 29 5e ec bc 53 ae 2f 15 7f 20 51 37 d1 |..A)^..S./.. Q7.|
+| c9 45 97 9d cc 33 21 53 52 a6 cd 4c 0d ae 9c 35 |.E...3!SR..L...5|
+| bf 24 4d 95 21 fa db 64 45 2c 79 9c 50 05 62 e8 |.$M.!..dE,y.P.b.|
+| 40 f9 95 d2 4e c3 d4 73 a4 c6 ea ce 27 df d8 bb |@...N..s....'...|
+| 03 f4 b9 b7 b0 6d 0d ac 68 87 6e 0a 6c dd 2e a9 |.....m..h.n.l...|
+| 45 8f 56 80 7a 1c 1a 3a e4 1e 2e fc 5e 36 9e cf |E.V.z..:....^6..|
+| 27 04 c9 49 f4 c7 ee 5d 50 32 30 6e 97 0a 06 6c |'..I...]P20n...l|
+| 49 13 f4 dc f9 d9 4a ea f5 4a 6f 0e 85 73 e4 46 |I.....J..Jo..s.F|
+| 26 67 c3 66 37 eb 30 05 1f 7f 40 f9 9a ee 22 77 |&g.f7.0...@..."w|
+| e0 a8 7d e5 e4 bc fd 55 56 45 e0 9d a7 08 d7 20 |..}....UVE..... |
+| 19 d2 c4 b1 dc 44 a7 6e 24 94 e0 5f 16 52 0e 79 |.....D.n$.._.R.y|
+| 62 bf 29 6c 7a e7 6a 60 97 4c d8 6f fc d4 ed c0 |b.)lz.j`.L.o....|
+| c3 ab 1c 5d 61 3b c2 16 a9 9c a2 af 51 d9 3b 80 |...]a;......Q.;.|
+| 5a b6 76 1e bb 5a e8 14 5e b9 6b f8 fb 64 ea 86 |Z.v..Z..^.k..d..|
+| 86 63 d5 ef 0b c4 af 4d 13 6e 70 2d cf 84 66 1f |.c.....M.np-..f.|
+| 20 40 f7 8b f5 1d 74 97 3f 9f 64 ea 74 ee 1a c1 | @....t.?.d.t...|
+| 34 aa 95 f1 94 69 d2 46 11 59 94 eb da 4c 62 03 |4....i.F.Y...Lb.|
+| 2a 0e 5d 28 38 4e d2 2a 0f c3 35 47 fe ef 18 02 |*.](8N.*..5G....|
+| 3f ba 8a 16 fd d3 22 ad 2c a3 4e 5f 32 3b fa 06 |?.....".,.N_2;..|
+| be 2c 86 2d cc 04 cc 13 bb 74 74 06 ce 04 3f e6 |.,.-.....tt...?.|
+| 34 02 c0 12 d8 12 85 24 96 20 7d dc a7 ac c1 73 |4......$. }....s|
+| b5 86 3a 57 bd 36 b2 5d ab 1c 34 b6 25 ef 23 fd |..:W.6.]..4.%.#.|
+| 08 70 a1 18 f9 a0 e6 ee e3 0a 07 b5 be c1 4a f0 |.p............J.|
+Plaintext[384]:
+| 13 7e 91 e2 f6 09 fe 19 48 54 54 50 2f 31 2e 31 |.~......HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 33 |che....0x00,0x13|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |DSS Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 55 7c 3d a5 5b 31 0f bd a7 68 12 1d |ipt>U|=.[1...h..|
+| 9e 1e 3e 8d c8 49 d9 fb 07 07 07 07 07 07 07 07 |..>..I..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 e5 78 6d b1 ab a3 e1 9c 04 a9 ed c1 18 47 75 |..xm..........Gu|
+| 57 48 1a d0 |WH.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4444 found 0x342db00
+
+dissect_ssl enter frame #147 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 46 e5 ca 45 bf 17 ae 99 1d 63 48 ac 68 a7 8f c0 |F..E.....cH.h...|
+| 04 85 49 77 c6 f0 2f 07 6b 2b 96 29 da fa 7f 1c |..Iw../.k+.)....|
+Plaintext[32]:
+| 2b db 5a 85 9f 08 7d 2a 01 00 3f 62 e6 81 09 83 |+.Z...}*..?b....|
+| a1 cb 1c a7 6d c6 77 b2 12 61 c7 b2 b0 a1 01 01 |....m.w..a......|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3f 62 e6 81 09 83 a1 cb 1c a7 6d c6 77 b2 12 61 |?b........m.w..a|
+| c7 b2 b0 a1 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #149 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 23 b5 78 ef 9c fd 59 77 25 f4 d1 11 9b 8a a6 4c |#.x...Yw%......L|
+| 3e de 4d 7c 56 4a e7 8d a1 ae 60 10 39 2d 24 3d |>.M|VJ....`.9-$=|
+Plaintext[32]:
+| d9 af 1f 9a d2 49 80 20 01 00 bf d8 8b 27 b3 fe |.....I. .....'..|
+| 69 fe e2 33 df ca 62 67 18 14 0d b9 2f fa 01 01 |i..3..bg..../...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf d8 8b 27 b3 fe 69 fe e2 33 df ca 62 67 18 14 |...'..i..3..bg..|
+| 0d b9 2f fa |../. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #154 (first time)
+ssl_session_init: initializing ptr 0x7facc3826bb0 size 688
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34412 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4446
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #156 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&|
+| 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.|
+| 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.|
+| 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. |
+hash out[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+PRF out[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+key expansion[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+Client MAC key[20]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 |.... |
+Server MAC key[20]:
+| 81 3c 17 4b ea 5b 38 48 44 0b 95 49 33 e8 ed ec |.<.K.[8HD..I3...|
+| 28 b9 92 2c |(.., |
+Client Write key[8]:
+| 5e be 00 1b 1d 30 f4 f0 |^....0.. |
+Server Write key[8]:
+| 18 7b 14 b0 b8 28 b0 27 |.{...(.' |
+Client Write IV[8]:
+| 4a 42 80 b6 5c 6d 9a 3a |JB..\m.: |
+Server Write IV[8]:
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #158 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7ca...
+looking for RSA pre-master00802a0d0f85b40a6903ecad2f96c85838fd915f30332c23...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&|
+| 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.|
+| 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.|
+| 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. |
+hash out[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+PRF out[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+key expansion[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+Client MAC key[20]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 |.\.. |
+Server MAC key[20]:
+| 66 4d c1 30 25 31 1f db f1 10 d5 01 8a c7 be e9 |fM.0%1..........|
+| ed 6d bb 1d |.m.. |
+Client Write key[8]:
+| 19 6e cb 8b c1 4b be 46 |.n...K.F |
+Server Write key[8]:
+| 0e f1 af d3 a8 40 ab b9 |.....@.. |
+Client Write IV[8]:
+| 5b ee 4b 96 c2 f2 fc e7 |[.K..... |
+Server Write IV[8]:
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b3 b6 3f 49 fc 09 ff a9 48 23 89 ce eb 96 cb 40 |..?I....H#.....@|
+| f4 01 16 65 eb a2 9c 3b 07 06 b2 ce 19 74 84 f3 |...e...;.....t..|
+| fa 1d 36 49 64 a8 d9 07 9b f7 9c ee a2 6a 62 f7 |..6Id........jb.|
+Plaintext[48]:
+| 0d 58 46 d4 81 13 c3 af 14 00 00 0c a6 c3 1a 90 |.XF.............|
+| 66 71 e6 58 35 bf 82 67 4b 33 ee 3b 64 a4 1c 28 |fq.X5..gK3.;d..(|
+| 63 d1 e4 03 68 9f 8b d5 f6 a9 99 4d 03 03 03 03 |c...h......M....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4b 33 ee 3b 64 a4 1c 28 63 d1 e4 03 68 9f 8b d5 |K3.;d..(c...h...|
+| f6 a9 99 4d |...M |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #159 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e3 a5 44 22 cf 49 d2 2c 86 74 db ca e4 89 2f eb |..D".I.,.t..../.|
+| 02 4d 14 46 12 6b f4 8d cd e8 e1 56 de 2c e9 b4 |.M.F.k.....V.,..|
+| 73 5b 3d ef 93 11 2f 22 e4 35 36 81 58 13 37 c0 |s[=.../".56.X.7.|
+Plaintext[48]:
+| 5a 53 b7 d8 09 0e 69 39 14 00 00 0c 89 dc 88 bc |ZS....i9........|
+| da 02 87 a9 e3 73 18 6d 8c 14 3d 07 e0 a6 ab 15 |.....s.m..=.....|
+| 47 60 d6 7f 57 f4 0e 6c 98 9c 03 79 03 03 03 03 |G`..W..l...y....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c 14 3d 07 e0 a6 ab 15 47 60 d6 7f 57 f4 0e 6c |..=.....G`..W..l|
+| 98 9c 03 79 |...y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #160 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 69 f8 b1 df d5 c9 14 65 da 4d dc cc cb 60 f6 70 |i......e.M...`.p|
+| 17 ce 72 33 63 28 75 31 47 d9 60 e7 86 1e 24 43 |..r3c(u1G.`...$C|
+| 1e 2f 8a 28 1c d1 af d7 62 7e 48 f7 4a 97 37 2d |./.(....b~H.J.7-|
+| 2c d6 31 92 cd e1 e6 aa 04 ea 83 49 6f 7e 86 e2 |,.1........Io~..|
+| e0 6a 91 b3 23 96 cf 14 ec 3d 74 41 ac 9b 87 ed |.j..#....=tA....|
+| 20 30 2b e6 4c 29 42 19 05 f9 7b 79 68 6e 6d 7a | 0+.L)B...{yhnmz|
+| a1 45 ab 4f 5b e0 12 5e |.E.O[..^ |
+Plaintext[104]:
+| e4 17 15 58 70 29 4b ad 47 45 54 20 2f 20 48 54 |...Xp)K.GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 2d 73 68 |h-rsa-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 36 0d 0a 0d |steyn.nl:4446...|
+| 0a b7 db 5d 0e f4 87 18 bc e9 71 24 4f 65 b0 34 |...]......q$Oe.4|
+| 88 b9 9b f3 f4 02 02 02 |........ |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4c f5 c4 9e d5 1d 75 68 cc fb 2a dd e2 ef c0 81 |L.....uh..*.....|
+| 11 ca 8b e4 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34412 found (nil)
+association_find: TCP port 4446 found 0x342dc20
+
+dissect_ssl enter frame #161 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 96 f2 81 e6 42 8c 20 31 a7 de b2 81 4a 35 4d 95 |....B. 1....J5M.|
+| 68 85 5d 50 c9 22 9c e8 0d 87 8f 3f ec 03 58 3d |h.]P.".....?..X=|
+| 39 b0 25 3b 99 d6 7f 3a ca 77 29 72 89 5c 3b 46 |9.%;...:.w)r.\;F|
+| 22 d9 13 ca 53 aa 28 bc 13 07 9a 36 db 38 3b ca |"...S.(....6.8;.|
+| 8a 48 a0 12 1b 90 80 38 7f 14 d8 a6 be fb 63 15 |.H.....8......c.|
+| 12 56 44 dd 21 5a 6e 36 1a fb 12 b0 ae 9c 4b a3 |.VD.!Zn6......K.|
+| b3 2f e9 42 d1 e9 48 45 ec 26 91 52 01 dc fa a6 |./.B..HE.&.R....|
+| 58 1e 0f 49 b0 cd 7d d0 99 f0 e1 86 43 c6 f8 84 |X..I..}.....C...|
+| f2 7a f9 31 c5 cb d6 3d 55 f9 81 e2 cf 33 3f 66 |.z.1...=U....3?f|
+| 23 af 96 71 ab 28 9d c9 42 99 7a 33 f9 d0 38 07 |#..q.(..B.z3..8.|
+| 8e d5 35 e8 68 a5 0f 53 21 08 ef 18 08 46 de 67 |..5.h..S!....F.g|
+| 1d 30 d6 9c 33 fa 98 91 55 fc 53 fc 44 9e a6 79 |.0..3...U.S.D..y|
+| 4d 90 53 aa b5 3e 0a d1 04 5e 4d 7e 27 d4 1b 87 |M.S..>...^M~'...|
+| 27 e0 18 1b e3 40 e1 a4 1c fb e7 5e 97 91 ba 15 |'....@.....^....|
+| 3e 76 f5 57 66 4b 15 ee 79 43 60 60 18 05 8e 52 |>v.WfK..yC``...R|
+| 11 2f ae 8c 06 44 a5 e5 ac 51 12 b2 7a b1 d4 10 |./...D...Q..z...|
+| 1d 3b f3 55 c4 ce de d0 71 a5 6a 4e eb 44 23 d6 |.;.U....q.jN.D#.|
+| 4e 75 49 46 7f c9 86 70 b1 64 5f 8e b5 5e 2b 1c |NuIF...p.d_..^+.|
+| 63 bb 83 00 f7 8e 88 b7 10 1e 50 6e f5 06 0a d4 |c.........Pn....|
+| 1a 27 a2 c8 c6 61 b9 39 a8 ee 82 1d 6f 18 b1 6d |.'...a.9....o..m|
+| 69 cd a5 0e 0e c3 ba 50 c0 de 12 d0 d5 51 70 57 |i......P.....QpW|
+| 09 02 d0 f2 71 aa 21 fc 39 de 0b 60 bf da fd 4f |....q.!.9..`...O|
+| f7 00 7e 32 03 d6 13 22 f2 07 a9 a6 23 e6 d2 13 |..~2..."....#...|
+| 45 cb 55 41 f6 5b 44 df a0 f6 64 4c 9c 2b 79 e7 |E.UA.[D...dL.+y.|
+Plaintext[384]:
+| 76 ac 3b fa b1 54 fa 6a 48 54 54 50 2f 31 2e 31 |v.;..T.jHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 35 |che....0x00,0x15|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e ef e0 8d f6 e3 0b ba 9e 8c ff 31 a8 |ipt>..........1.|
+| 60 89 37 f1 94 ad fd a2 07 07 07 07 07 07 07 07 |`.7.............|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c6 8e 88 6c 4a 0d 2f 24 5a e6 9d 8b ed 1c 68 0f |...lJ./$Z.....h.|
+| 59 41 2e 7d |YA.} |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4446 found 0x342dc20
+
+dissect_ssl enter frame #162 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 90 f6 07 04 e0 4a 07 59 f3 0d 7c 9d c1 fc d7 8a |.....J.Y..|.....|
+| fb d1 9d 5f 88 e9 38 90 30 0f 6f e4 69 5d 4a 1a |..._..8.0.o.i]J.|
+Plaintext[32]:
+| 0c 1a e1 d4 78 6a da 00 01 00 9c 5a 40 9d db f4 |....xj.....Z@...|
+| 05 13 fa 7e 0e cd 31 cd 8d d0 df 9c 0a da 01 01 |...~..1.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 5a 40 9d db f4 05 13 fa 7e 0e cd 31 cd 8d d0 |.Z@......~..1...|
+| df 9c 0a da |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #164 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 7d d7 c0 e6 96 9e 50 c3 7f d0 b5 0d cc dd 53 da |}.....P.......S.|
+| 00 42 4e 39 07 ec 5e 40 5f 00 f0 c5 3b 4c 04 78 |.BN9..^@_...;L.x|
+Plaintext[32]:
+| e2 0d bf b8 8a be e4 0b 01 00 de 63 97 d3 6f d6 |...........c..o.|
+| ad f1 c0 fc 08 53 a9 a7 e9 d6 c5 46 d0 da 01 01 |.....S.....F....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| de 63 97 d3 6f d6 ad f1 c0 fc 08 53 a9 a7 e9 d6 |.c..o......S....|
+| c5 46 d0 da |.F.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #169 (first time)
+ssl_session_init: initializing ptr 0x7facc38290b0 size 688
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34630 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4447
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #171 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....|
+| 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.|
+| 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.|
+| 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ |
+hash out[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+PRF out[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+key expansion[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+Client MAC key[20]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb |&B.. |
+Server MAC key[20]:
+| 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 fe 14 37 f3 |...A.j.~.#CR..7.|
+| bd 43 0e af |.C.. |
+Client Write key[24]:
+| e9 bf 44 8f 11 9c 68 9a d3 37 a3 40 39 62 09 8b |..D...h..7.@9b..|
+| b8 79 3b 5e d1 73 93 10 |.y;^.s.. |
+Server Write key[24]:
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 |...~h..Y |
+Client Write IV[8]:
+| cc bd 9c 99 62 ff 6c e8 |....b.l. |
+Server Write IV[8]:
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #173 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312...
+looking for RSA pre-master008027b568fcd473db04087fdc9b05310f3c92161bfb26f1...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....|
+| 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.|
+| 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.|
+| 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ |
+hash out[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+PRF out[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+key expansion[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+Client MAC key[20]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 |VO.. |
+Server MAC key[20]:
+| 7e fb 12 39 31 6f ee 5b 60 90 90 b6 77 e0 70 41 |~..91o.[`...w.pA|
+| 92 17 12 71 |...q |
+Client Write key[24]:
+| 5e ed bf 9a a0 fe 96 7f d5 7b 92 8d 8c b3 5e 40 |^........{....^@|
+| 78 f7 06 49 d9 c2 4f 90 |x..I..O. |
+Server Write key[24]:
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 |z.|..*.! |
+Client Write IV[8]:
+| 7f 2b 21 ed eb 3c b3 bb |.+!..<.. |
+Server Write IV[8]:
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 30 b9 99 b5 98 3a 51 ba 34 9f 5f c3 fa 03 14 a5 |0....:Q.4._.....|
+| ff 2b 4c e7 1d 75 8e 9b 9f 7e 1a f7 9c 04 c5 7b |.+L..u...~.....{|
+| ef 9d e7 8d d3 52 a8 f2 60 1e 56 3e 94 1c 79 75 |.....R..`.V>..yu|
+Plaintext[48]:
+| 11 54 ba b8 2b 47 c3 13 14 00 00 0c d4 0c 3a 75 |.T..+G........:u|
+| 2f ae 37 1c 80 8e f4 b6 bf eb f9 f3 74 05 e3 b2 |/.7.........t...|
+| 8a 91 5f 39 26 39 24 10 89 96 19 d6 03 03 03 03 |.._9&9$.........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf eb f9 f3 74 05 e3 b2 8a 91 5f 39 26 39 24 10 |....t....._9&9$.|
+| 89 96 19 d6 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #174 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 43 b9 41 64 c5 c1 70 d9 95 40 43 89 6d 6a 0f 7e |C.Ad..p..@C.mj.~|
+| 1f b0 d1 8b 8e cc 05 85 5e 1d 64 05 7f c3 18 6c |........^.d....l|
+| 1b 6f fb 98 8c 36 f4 92 5f 58 6d 29 af b8 1b b3 |.o...6.._Xm)....|
+Plaintext[48]:
+| 3e 8c 1e 41 11 1c 02 94 14 00 00 0c b1 af 5a f7 |>..A..........Z.|
+| 46 79 f1 9d 13 16 f8 d6 77 48 26 28 97 92 87 35 |Fy......wH&(...5|
+| 2e 9a 77 58 79 64 5d 3f 37 26 30 58 03 03 03 03 |..wXyd]?7&0X....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 77 48 26 28 97 92 87 35 2e 9a 77 58 79 64 5d 3f |wH&(...5..wXyd]?|
+| 37 26 30 58 |7&0X |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #175 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 52 25 de 8e dc 51 1e 44 7a 04 36 3a fe f7 5a 2a |R%...Q.Dz.6:..Z*|
+| f8 c6 0a 28 6a be ce 44 47 9c 36 9c d8 16 86 a8 |...(j..DG.6.....|
+| b5 23 27 08 96 eb 4c dc 09 0d 57 27 71 3f 75 cb |.#'...L...W'q?u.|
+| 04 3f 78 fa a6 3c 32 bc ec 2a 1e 66 71 b3 22 bd |.?x..<2..*.fq.".|
+| b7 0a bd 82 68 aa 70 a1 cd 99 a9 70 c8 cd 74 a5 |....h.p....p..t.|
+| ad 7f 52 6f d0 71 4e 94 d3 09 dc 9f 01 d5 d2 4e |..Ro.qN........N|
+| f9 48 cc ac 0a 66 40 37 |.H...f@7 |
+Plaintext[104]:
+| c8 61 50 07 a9 8d 67 44 47 45 54 20 2f 20 48 54 |.aP...gDGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 2d 73 |h-rsa-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 37 0d 0a |nsteyn.nl:4447..|
+| 0d 0a 4d a5 7b 38 2e 13 89 3f e6 db 22 e5 fa 38 |..M.{8...?.."..8|
+| f2 c8 c6 33 1e c6 01 01 |...3.... |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 2f 5b bd d8 8f 3f f3 2f 99 b0 8a ef fc 8b df |]/[...?./.......|
+| a4 d6 01 22 |..." |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34630 found (nil)
+association_find: TCP port 4447 found 0x342dcb0
+
+dissect_ssl enter frame #176 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c6 a7 90 28 b2 f1 b7 15 43 62 7a 8e 57 14 47 11 |...(....Cbz.W.G.|
+| 8b 43 bb 7f c5 53 21 ef 53 53 a5 a0 11 37 66 6f |.C...S!.SS...7fo|
+| 1a db 78 e4 e2 3c 2e 19 51 bb ec 08 06 33 6e ac |..x..<..Q....3n.|
+| c8 96 d3 5d 06 de 57 71 89 ad 14 97 38 9f f2 f2 |...]..Wq....8...|
+| 05 06 8c 49 c0 00 0f 08 de 60 e2 2c ed 57 bd 7a |...I.....`.,.W.z|
+| b0 75 2e 8f 92 28 5e 0a 49 ef 83 86 4f 05 eb f9 |.u...(^.I...O...|
+| f5 4a 7a 69 e2 bc d5 be 68 c7 52 b9 3c 98 b3 50 |.Jzi....h.R.<..P|
+| ae b3 de 52 cc a7 61 fd bf af a9 f0 e3 cc d6 54 |...R..a........T|
+| 9b 45 a5 94 26 58 87 cf 51 63 aa 82 56 9b 3e b1 |.E..&X..Qc..V.>.|
+| fe 6f 12 74 f2 1c ae 8b 7c 7b bd a4 c0 d0 6f 17 |.o.t....|{....o.|
+| b9 50 61 6e 51 02 32 19 54 1a 57 a2 d5 9e a5 0a |.PanQ.2.T.W.....|
+| 14 3c e9 f7 11 84 7d ad e8 d7 7d 0c 07 4c 3f 57 |.<....}...}..L?W|
+| ac 44 b8 a9 f0 c7 2e db 53 12 81 99 4a 0e 6a e4 |.D......S...J.j.|
+| c6 fb 54 9b bf 9a c3 e2 a9 f0 68 34 c3 95 74 34 |..T.......h4..t4|
+| 6c f2 8c 77 3d 57 b7 a0 c3 f8 cd 04 5b 15 5e 41 |l..w=W......[.^A|
+| 53 13 85 50 fc 72 27 a2 7b 84 0b b1 66 9b a5 eb |S..P.r'.{...f...|
+| 35 ad e4 cf fa 58 29 07 78 79 f5 14 c0 34 2d b2 |5....X).xy...4-.|
+| a2 b9 25 1c 87 83 63 13 c3 60 87 b7 c9 94 5f 10 |..%...c..`...._.|
+| 4e 5a 94 63 18 2f 23 39 1b 0e f3 d5 13 27 a8 a5 |NZ.c./#9.....'..|
+| 51 9f 1c e3 c1 6e 24 b7 c6 ec 19 a2 8b a0 37 8e |Q....n$.......7.|
+| 3e 5e da aa 5e 37 9f 36 c6 d3 33 15 96 a2 7b 62 |>^..^7.6..3...{b|
+| 63 1b 6a af 83 e8 48 71 77 92 13 49 5f 09 53 5a |c.j...Hqw..I_.SZ|
+| 81 b0 a7 be 34 02 fe dd 05 41 32 91 41 df 80 9a |....4....A2.A...|
+| 4e 78 88 1c a7 90 dd 6a 98 9b ec a0 73 0c 1a 1a |Nx.....j....s...|
+Plaintext[384]:
+| 15 08 3a 52 13 84 ff 32 48 54 54 50 2f 31 2e 31 |..:R...2HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 36 |che....0x00,0x16|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e e2 99 45 65 8c 16 05 3b 22 43 65 8b |ipt>..Ee...;"Ce.|
+| bb 26 09 2a 69 d1 2c 94 07 07 07 07 07 07 07 07 |.&.*i.,.........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6e 38 8e 36 a4 fc f7 22 c3 52 d5 c3 70 e0 30 e9 |n8.6...".R..p.0.|
+| fc bb 46 de |..F. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4447 found 0x342dcb0
+
+dissect_ssl enter frame #177 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 55 ee a8 58 43 84 d9 46 e9 af a2 07 a7 c0 5a e5 |U..XC..F......Z.|
+| 9b f6 7e d0 b3 3d 25 37 88 45 a1 00 c8 e7 dc be |..~..=%7.E......|
+Plaintext[32]:
+| 28 c5 00 a5 16 dd 5e e0 01 00 d3 7a ba cf ea 38 |(.....^....z...8|
+| ec 1b 2d ef 78 0d 34 2f 3c 11 c4 bf 08 70 01 01 |..-.x.4/<....p..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d3 7a ba cf ea 38 ec 1b 2d ef 78 0d 34 2f 3c 11 |.z...8..-.x.4/<.|
+| c4 bf 08 70 |...p |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #179 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 76 68 33 16 36 aa 6b 09 b6 a9 34 b1 61 c6 fb e3 |vh3.6.k...4.a...|
+| b3 8d dd 81 3c e8 4e 02 9b 85 fe 37 c5 24 96 97 |....<.N....7.$..|
+Plaintext[32]:
+| f2 a4 38 4d 1e 1c 93 cd 01 00 a9 6f f3 6d 2b ba |..8M.......o.m+.|
+| a6 3d 8a 8c 6b 65 e4 84 4c 61 1e 50 86 a7 01 01 |.=..ke..La.P....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a9 6f f3 6d 2b ba a6 3d 8a 8c 6b 65 e4 84 4c 61 |.o.m+..=..ke..La|
+| 1e 50 86 a7 |.P.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #184 (first time)
+ssl_session_init: initializing ptr 0x7facc382b5b0 size 688
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56585 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4448
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #186 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.|
+| 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.|
+| 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>|
+| a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 |
+hash out[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+PRF out[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+key expansion[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+Client MAC key[20]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 |.... |
+Server MAC key[20]:
+| 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa ad d1 8c e4 |....."v.........|
+| 18 60 e9 b7 |.`.. |
+Client Write key[16]:
+| 17 32 20 aa 71 e4 51 58 de 29 07 4f ff 5f 42 28 |.2 .q.QX.).O._B(|
+Server Write key[16]:
+| d3 6a 06 82 7d 52 e0 44 ee 97 db df 7c c4 f5 41 |.j..}R.D....|..A|
+Client Write IV[16]:
+| 20 8e 7e 43 da 31 84 17 ac 47 27 8a 28 19 f1 07 | .~C.1...G'.(...|
+Server Write IV[16]:
+| 22 b5 68 ef 27 e0 f2 e4 ed cc 53 e8 a9 38 28 61 |".h.'.....S..8(a|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #188 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b45632...
+looking for RSA pre-master9c6ff5543ffe32d8ea3a28bd01a06a2390bf507ff9296aa5...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.|
+| 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.|
+| 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>|
+| a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 |
+hash out[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+PRF out[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+key expansion[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+Client MAC key[20]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 |...Q |
+Server MAC key[20]:
+| b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 52 0a 0e 02 |.>m_.U_.....R...|
+| 08 16 57 da |..W. |
+Client Write key[16]:
+| ab 14 c4 af 42 91 20 e7 7b ab 41 ae 53 6e cd f4 |....B. .{.A.Sn..|
+Server Write key[16]:
+| 0c bc fb 0d 51 58 b0 25 f8 2f ad 6d 7f 2a 02 13 |....QX.%./.m.*..|
+Client Write IV[16]:
+| 88 73 65 2e c7 b4 3d 1c 94 d0 61 28 cb 66 35 71 |.se...=...a(.f5q|
+Server Write IV[16]:
+| 8d 3c 54 51 6b a4 ad 6e b9 f8 29 05 96 08 f3 3a |.<TQk..n..)....:|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c4 5f 91 3d 25 a3 a0 22 e2 b3 ce d7 2f bc a8 c4 |._.=%.."..../...|
+| cb c5 84 32 41 c8 2b 56 21 8a 35 52 8d 10 75 8e |...2A.+V!.5R..u.|
+| 88 64 2e 9f d2 3d de 0b 9f 0c 81 7b 8d 4d 84 7d |.d...=.....{.M.}|
+| 13 f2 7a de a0 b1 7c f2 49 47 a3 1d 54 d8 21 c2 |..z...|.IG..T.!.|
+Plaintext[64]:
+| 42 32 46 39 d0 4d be 41 8f fd 10 5c 03 8d bd e5 |B2F9.M.A...\....|
+| 14 00 00 0c d7 7e 6a cc d7 b3 00 df 6d b0 63 5c |.....~j.....m.c\|
+| cc 88 c6 58 79 79 94 70 2c c0 96 b2 46 46 3b b8 |...Xyy.p,...FF;.|
+| 9c 03 33 23 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..3#............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc 88 c6 58 79 79 94 70 2c c0 96 b2 46 46 3b b8 |...Xyy.p,...FF;.|
+| 9c 03 33 23 |..3# |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #189 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c1 95 8f 38 a1 6a 07 72 17 43 58 54 ce 3a 60 16 |...8.j.r.CXT.:`.|
+| 81 0e 88 88 0c 61 ef 44 7d f2 42 30 f5 3b 3b ed |.....a.D}.B0.;;.|
+| a6 d6 ad 17 8d 28 b9 83 3f 0a 28 5c 52 14 10 6a |.....(..?.(\R..j|
+| 99 3f 04 51 28 5f 2a c8 73 bc 67 8d b5 bb e3 00 |.?.Q(_*.s.g.....|
+Plaintext[64]:
+| 7a 52 ad d1 45 cd ea e1 f0 72 5d 2d d8 ec 3b c0 |zR..E....r]-..;.|
+| 14 00 00 0c 85 21 68 ab 47 e2 12 2b 15 da 6e 75 |.....!h.G..+..nu|
+| a1 ed 97 a5 ed e6 97 53 8a ca f2 f2 f1 e1 96 ab |.......S........|
+| 9d 69 73 dc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.is.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 ed 97 a5 ed e6 97 53 8a ca f2 f2 f1 e1 96 ab |.......S........|
+| 9d 69 73 dc |.is. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #190 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| e1 38 a1 61 b3 19 97 8a bc 0f 7b c6 39 7f 51 73 |.8.a......{.9.Qs|
+| e3 3f c7 f3 a9 cc 79 13 3a fa c8 4e f4 32 a5 2e |.?....y.:..N.2..|
+| 03 da a6 93 d0 62 a3 4c 69 b2 8e 0d 79 8f 63 ec |.....b.Li...y.c.|
+| f3 dc fd da cc 76 d3 ab 35 10 21 22 ef 16 f1 5d |.....v..5.!"...]|
+| a8 e8 35 a7 88 77 fc 30 c1 a9 cc 2a 6f 2d 3b 16 |..5..w.0...*o-;.|
+| 18 81 40 b2 41 6a e7 b5 27 6b 9b 13 97 39 9e 9e |..@.Aj..'k...9..|
+| 9b 64 79 71 19 73 c6 6b 3b 29 5a a9 b0 a0 ec 24 |.dyq.s.k;)Z....$|
+Plaintext[112]:
+| f7 fe 40 28 7b 7e 0b 38 a1 02 cd 75 e6 1c 3e 78 |..@({~.8...u..>x|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....|
+| 90 ab af 77 9f 92 99 2f 13 ca b2 56 b2 0a 6c 6a |...w.../...V..lj|
+| af 9c 0b fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc ad 88 d7 c0 ce ec 90 81 5c f5 2b dd 8b 99 6e |.........\.+...n|
+| 3b be 1b 69 |;..i |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56585 found (nil)
+association_find: TCP port 4448 found 0x342dd40
+
+dissect_ssl enter frame #191 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 18 93 55 f3 49 26 2e 7f e3 2e 94 24 ca 57 3a 5b |..U.I&.....$.W:[|
+| 21 e3 43 4d bf 63 46 ee e3 6a e9 07 96 68 30 57 |!.CM.cF..j...h0W|
+| 94 15 f0 2c 57 37 23 39 2f f7 bc cd fb 4d 15 8f |...,W7#9/....M..|
+| f6 88 0d 09 fa 08 ab 34 fd b9 59 1b 4b 4a ee 81 |.......4..Y.KJ..|
+| 1d e9 14 80 1a 89 68 bf e0 2e 69 53 b9 17 00 96 |......h...iS....|
+| a1 69 1d 6e 69 0e 2a 0f 1e 82 d1 56 2d 05 64 31 |.i.ni.*....V-.d1|
+| e4 44 a4 4f fa 23 a6 fc 68 32 be 15 f6 b9 ac 6f |.D.O.#..h2.....o|
+| 19 30 ea 4d a1 08 04 65 03 17 91 88 b6 0e be 78 |.0.M...e.......x|
+| ec 3e 35 d7 89 dd d1 5b 16 b9 ac 75 2c 7e e7 ab |.>5....[...u,~..|
+| 50 4f b7 73 ca 30 fd f6 a1 4c c9 ab 85 08 5e 09 |PO.s.0...L....^.|
+| 71 b5 bf ee 5e b0 92 06 0a 43 5b c7 16 f3 71 ab |q...^....C[...q.|
+| ed ae 5f e2 2d 8e d1 2d 45 ba 20 aa 4f ce ad 60 |.._.-..-E. .O..`|
+| 33 9d b0 7f dd 4e 60 c0 18 52 92 1b 72 98 d6 79 |3....N`..R..r..y|
+| 9a a5 18 fc 48 73 77 42 10 dc 13 20 55 16 cb ec |....HswB... U...|
+| 61 c5 71 86 fa 22 9b f2 a5 f0 ed 54 cb 96 a1 4d |a.q..".....T...M|
+| e3 af 35 c0 98 48 86 2a 7c 20 60 61 f2 82 6b 06 |..5..H.*| `a..k.|
+| 9b e1 9b 28 8a 99 8b c8 be 95 6b f6 76 c5 89 fb |...(......k.v...|
+| 3c 60 01 ed 6b 44 df 94 dd f8 9e cc a2 01 30 02 |<`..kD........0.|
+| 9f 71 30 82 33 21 89 92 02 d1 e5 bf f6 8a 94 f8 |.q0.3!..........|
+| bc 21 09 a0 c1 9f aa 0a 6d 82 43 0a e4 a0 a5 59 |.!......m.C....Y|
+| b4 e0 38 26 6e 13 03 61 d1 2e bc ab 61 94 c2 0d |..8&n..a....a...|
+| 60 b8 d4 92 73 3a bf f8 90 ee f9 92 f5 3d 10 57 |`...s:.......=.W|
+| 68 a8 65 11 94 be b2 4c 7a d7 72 a7 56 b0 15 71 |h.e....Lz.r.V..q|
+| 3f cd 2f 1a c4 c9 3f 27 d0 bc 0f aa fa b2 14 81 |?./...?'........|
+| f2 e2 ac 23 1d 5d 6e 09 34 b8 b9 ee 35 29 93 e0 |...#.]n.4...5)..|
+Plaintext[400]:
+| 1b bd f3 c6 cc 1c 1c f8 eb af 5e 18 ba bd c3 40 |..........^....@|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12|
+| 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9b 46 ca 65 |nl'</script>.F.e|
+| 92 cf d8 33 79 d6 e7 4c 0e 7a 91 81 cc 1b 00 43 |...3y..L.z.....C|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 55 4f b0 3a ac 07 a7 cb 7e f5 2b a5 9d 48 19 71 |UO.:....~.+..H.q|
+| 56 15 b9 89 |V... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4448 found 0x342dd40
+
+dissect_ssl enter frame #192 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2d 7e 64 d1 d4 bb b7 06 06 ab 93 21 37 b1 58 fd |-~d........!7.X.|
+| 98 fe 27 e2 6a 7c b3 6a d7 be be 21 6e 6a 8b 98 |..'.j|.j...!nj..|
+| 91 c8 8d 1c 36 d5 84 4f b8 23 02 24 d8 cf 62 ad |....6..O.#.$..b.|
+Plaintext[48]:
+| c1 5d 52 33 77 47 a6 d0 8b 1c eb 6b 9f 6d 9f e6 |.]R3wG.....k.m..|
+| 01 00 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 |..a8....i...$..'|
+| 21 a9 28 c0 97 19 09 09 09 09 09 09 09 09 09 09 |!.(.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 21 a9 |a8....i...$..'!.|
+| 28 c0 97 19 |(... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #194 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9c e0 8b 42 4a b9 05 46 ad ff 69 7f 0b c3 4c bf |...BJ..F..i...L.|
+| af be 30 e2 fc 0b 9e 2c 6c d0 9d 07 ea f4 fc 48 |..0....,l......H|
+| 9e e4 f8 34 c8 a8 bd bb fb c2 90 33 f2 78 83 78 |...4.......3.x.x|
+Plaintext[48]:
+| 0a 8b 34 b0 63 e9 d4 58 35 28 31 6b a8 69 1d 4c |..4.c..X5(1k.i.L|
+| 01 00 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a |..Y.8.d.........|
+| 59 35 7c 63 c2 dc 09 09 09 09 09 09 09 09 09 09 |Y5|c............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a 59 35 |Y.8.d.........Y5|
+| 7c 63 c2 dc ||c.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #199 (first time)
+ssl_session_init: initializing ptr 0x7facc382db70 size 688
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35174 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4449
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #201 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 74 a6 ef e0 bc d2 ba 17 49 cc b8 fe d7 c3 f2 |"t.......I......|
+| 01 4f 63 f5 29 9b d4 47 2e 9f db 9d 67 52 34 bf |.Oc.)..G....gR4.|
+| 22 f0 fc 88 02 6c b6 7e 23 6c 61 77 46 7a cc ef |"....l.~#lawFz..|
+| 60 aa fc 47 82 6c 7c 58 87 4b 5f d5 6a |`..G.l|X.K_.j |
+hash out[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+PRF out[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+key expansion[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+Client MAC key[20]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 |.*Q. |
+Server MAC key[20]:
+| 5e 90 18 dd c0 fe dc 76 36 24 25 9b fc 67 17 6a |^......v6$%..g.j|
+| 8f 31 72 da |.1r. |
+Client Write key[16]:
+| 02 3b e7 51 e1 4e f6 c2 11 f7 30 84 0e 70 45 44 |.;.Q.N....0..pED|
+Server Write key[16]:
+| ac 66 a0 8c b3 41 44 26 fa a2 45 07 af 74 fb 7d |.f...AD&..E..t.}|
+Client Write IV[16]:
+| 6c a0 c8 88 b0 09 de 6c 0d ee 53 22 fe 91 78 f9 |l......l..S"..x.|
+Server Write IV[16]:
+| be e3 54 ac 03 24 0d 7b e3 ad bd 37 f8 4c e3 9b |..T..$.{...7.L..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #203 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc4782...
+looking for RSA pre-master0080b9b978bd5956049bf352b112da25a73a33242f9817c7...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 74 a6 ef e0 bc d2 ba 17 49 cc b8 fe d7 c3 f2 |"t.......I......|
+| 01 4f 63 f5 29 9b d4 47 2e 9f db 9d 67 52 34 bf |.Oc.)..G....gR4.|
+| 22 f0 fc 88 02 6c b6 7e 23 6c 61 77 46 7a cc ef |"....l.~#lawFz..|
+| 60 aa fc 47 82 6c 7c 58 87 4b 5f d5 6a |`..G.l|X.K_.j |
+hash out[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+PRF out[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+key expansion[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+Client MAC key[20]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 |...R |
+Server MAC key[20]:
+| b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 53 dc a5 ba |.....(..S:[.S...|
+| c0 49 44 a0 |.ID. |
+Client Write key[16]:
+| 53 f2 f7 ad 6d 66 6e a7 bf ff bc da 68 02 3c f7 |S...mfn.....h.<.|
+Server Write key[16]:
+| d2 d8 6a 60 a7 20 6d 49 de 7f e5 ea ea 22 d6 03 |..j`. mI....."..|
+Client Write IV[16]:
+| d0 a8 3c aa ee b8 a3 c8 fa 52 3d 5e ed 97 c1 30 |..<......R=^...0|
+Server Write IV[16]:
+| 40 5e be ed 08 fb 46 d7 9c a5 39 a0 b8 8d 7a ee |@^....F...9...z.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1a aa 5b 13 c1 e5 c2 55 12 09 6b 60 5b 4a 84 c0 |..[....U..k`[J..|
+| 65 a6 5e 50 3b 45 44 17 49 82 1c ff 91 bd 57 43 |e.^P;ED.I.....WC|
+| 59 e1 34 5b 6c 39 d9 56 c4 07 a7 91 7a 05 0f ff |Y.4[l9.V....z...|
+| 49 b5 78 5d 4f d6 27 87 cb d7 2b 30 92 74 45 89 |I.x]O.'...+0.tE.|
+Plaintext[64]:
+| c9 72 a6 91 af 7b f6 9f 3c 98 45 ae bd 13 51 18 |.r...{..<.E...Q.|
+| 14 00 00 0c 13 88 0e 46 45 6b fe 15 52 62 b0 1c |.......FEk..Rb..|
+| cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..|
+| fc 51 3e 56 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Q>V............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..|
+| fc 51 3e 56 |.Q>V |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #204 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8c cb 3d c7 4b 41 55 a1 6c 88 db a7 f2 7b 12 d6 |..=.KAU.l....{..|
+| f0 76 38 7d ff 01 bd f8 30 b8 1b ba bb ea 91 b6 |.v8}....0.......|
+| 2b 5d c9 7e 3b a7 a4 06 fc f0 6b d9 d1 81 55 56 |+].~;.....k...UV|
+| fe 9a 56 f3 3f dc 01 61 1c 7f 69 a7 6f 9f ce 1a |..V.?..a..i.o...|
+Plaintext[64]:
+| d0 72 3d d9 78 4a 2e 8b 82 8e 64 2c 0a 71 8b 5c |.r=.xJ....d,.q.\|
+| 14 00 00 0c 7b f3 4d d3 23 a2 c1 bc 5f d5 4c 84 |....{.M.#..._.L.|
+| 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@|
+| c5 60 09 e3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.`..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@|
+| c5 60 09 e3 |.`.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #205 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 95 c2 42 13 da cc 84 b5 31 bb cc 7a 2d 8c 3a c5 |..B.....1..z-.:.|
+| 76 da 0f 00 83 0b db 4e 1a 04 b1 27 fc 8c a1 f7 |v......N...'....|
+| 0a be 0e 78 40 18 8a bd 20 cb fe f6 ff d3 9b c2 |...x@... .......|
+| fc 91 7a d5 b3 35 51 02 b9 1a 82 32 80 91 2c d2 |..z..5Q....2..,.|
+| fb f7 a1 e9 32 d2 37 32 73 76 16 29 68 52 7c a9 |....2.72sv.)hR|.|
+| 7a 69 6f eb 7c fc 50 83 5b 5f b5 72 4b b5 69 29 |zio.|.P.[_.rK.i)|
+| f1 25 40 c2 ba b0 41 ef 53 de 28 83 d0 fa 6b f8 |.%@...A.S.(...k.|
+Plaintext[112]:
+| ce 37 c8 32 fa f8 2f 01 1c a4 d7 d2 53 c2 74 73 |.7.2../.....S.ts|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 34 39 0d 0a 0d 0a 72 a0 8f 78 7e a3 57 49 |4449....r..x~.WI|
+| 6b ca 69 7b 19 37 aa d9 ef 6c 18 40 03 03 03 03 |k.i{.7...l.@....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 42 10 d3 40 4f e3 b3 15 17 78 c0 5d 6c 43 17 20 |B..@O....x.]lC. |
+| 5f 43 42 1b |_CB. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35174 found (nil)
+association_find: TCP port 4449 found 0x342ddd0
+
+dissect_ssl enter frame #206 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| f9 c6 ca af d9 57 23 46 a9 cb e8 f7 3d 3b 8f 42 |.....W#F....=;.B|
+| fd 80 9a f0 70 a7 d9 84 9b 04 f5 e3 01 58 d7 88 |....p........X..|
+| 96 50 80 23 a7 7d 9c 7d 14 c9 19 e5 86 be ad b8 |.P.#.}.}........|
+| 86 65 11 e5 79 e2 f4 60 1f b7 fa bd 8f 4e 72 46 |.e..y..`.....NrF|
+| e8 b7 66 e5 09 54 fa 10 ae 96 61 4b 5c b4 3c e3 |..f..T....aK\.<.|
+| b9 35 a4 ef a6 ef c5 0c 81 ad 4b 5b bb 96 6c 0d |.5........K[..l.|
+| 2a 95 67 3c 7b 31 b8 81 e7 06 fc aa 7c 3d 6c 75 |*.g<{1......|=lu|
+| 3c 06 fb ec d6 57 5c 4d 55 14 8e 7e ab db de 54 |<....W\MU..~...T|
+| 7a 5b 60 cd dd b7 35 94 77 b4 ad 99 8b cd 34 97 |z[`...5.w.....4.|
+| c0 bb a9 7a 0d 6f 53 ce 76 8f e8 51 8a 8c dc f8 |...z.oS.v..Q....|
+| 5a b4 86 58 63 0f 91 5e c5 b3 d0 09 6a ca 6a f2 |Z..Xc..^....j.j.|
+| c9 b5 20 83 90 17 d2 7e 88 47 ba 95 89 ec dd 4a |.. ....~.G.....J|
+| d1 c4 cd 4f 22 40 cb 9d 6e 22 59 c6 66 dd 3f 48 |...O"@..n"Y.f.?H|
+| fa cd 37 c9 0a bd 29 8f 9a 70 b2 2a 2a 5d 36 24 |..7...)..p.**]6$|
+| 53 da db 7c 51 1c 93 67 cf a4 b2 db 3e 94 bc f5 |S..|Q..g....>...|
+| 88 be 16 d1 09 da ed 29 a6 ac 5b e5 b8 08 24 32 |.......)..[...$2|
+| 85 58 ae 47 c6 8c 77 e6 28 3a f2 49 00 d1 26 1e |.X.G..w.(:.I..&.|
+| 3e 1d fb 01 d1 cf ac 95 97 04 59 10 91 fb 47 1a |>.........Y...G.|
+| 91 11 fd 85 8d 79 14 56 35 16 66 ad 91 50 c8 3a |.....y.V5.f..P.:|
+| 5e 6c f4 f2 02 6c de a2 d6 cf 48 b3 c3 8f 1b c8 |^l...l....H.....|
+| 49 21 4c 5d 6c 49 49 43 29 88 0c ef 94 a8 d7 60 |I!L]lIIC)......`|
+| cf 72 be 34 54 cb b6 9e f2 c3 e6 d3 56 fc ab 4a |.r.4T.......V..J|
+| 5a f3 46 1d c4 98 ad 96 e4 bf 74 33 6b 74 a5 2e |Z.F.......t3kt..|
+| 28 d9 6e 6e b1 c1 7f e3 a1 d7 24 9c 0c 75 a7 fc |(.nn......$..u..|
+| 9c 74 64 3d fc 29 55 85 1b 6d fc ce df f3 98 44 |.td=.)U..m.....D|
+Plaintext[400]:
+| 8c 98 a2 4f 4b 5e c6 7b da 49 3c ff 53 de d6 70 |...OK^.{.I<.S..p|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D|
+| 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e be 07 e7 8d |nl'</script>....|
+| d4 2c d0 de 99 91 8d 2d a9 fe df a6 6b 27 96 3e |.,.....-....k'.>|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 57 0f 53 9a 8b 11 3b 7d fe 4c 8a 99 10 4f e4 |yW.S...;}.L...O.|
+| f8 1c 52 00 |..R. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4449 found 0x342ddd0
+
+dissect_ssl enter frame #207 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| cc 91 6e 69 2b ad f6 5d 0f 4c 48 28 a3 cb 08 c4 |..ni+..].LH(....|
+| 96 35 79 19 88 e9 4a f8 85 ef f6 73 b9 ff b7 41 |.5y...J....s...A|
+| 1c 8f 19 66 77 97 2b 8f 51 44 1b de ce ee 0c e3 |...fw.+.QD......|
+Plaintext[48]:
+| 72 0d d0 89 07 ec 22 1c c3 7a f4 20 15 8c 15 20 |r....."..z. ... |
+| 01 00 d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 |......l.<..q..Us|
+| 2a 4c 83 f1 9f 36 09 09 09 09 09 09 09 09 09 09 |*L...6..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 2a 4c |....l.<..q..Us*L|
+| 83 f1 9f 36 |...6 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #209 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 90 aa ba 12 d1 e9 9a 9d aa 5a cd 26 66 dc ac 01 |.........Z.&f...|
+| 39 9f a1 98 a5 ec 81 97 7d 87 5a 9e 8e 58 c1 4d |9.......}.Z..X.M|
+| 21 80 07 64 7d 28 ac d2 f5 c9 51 98 2b b3 36 fb |!..d}(....Q.+.6.|
+Plaintext[48]:
+| 4a 36 7b 03 9d a9 ed 83 0e 67 07 9f e4 8b 7c ae |J6{......g....|.|
+| 01 00 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d |..S.g.......6E..|
+| 59 f6 a7 97 a5 d5 09 09 09 09 09 09 09 09 09 09 |Y...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d 59 f6 |S.g.......6E..Y.|
+| a7 97 a5 d5 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #214 (first time)
+ssl_session_init: initializing ptr 0x7facc3830070 size 688
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53394 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4450
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #216 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..|
+| 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.|
+| 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...|
+| 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... |
+hash out[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+PRF out[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+key expansion[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+Client MAC key[20]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd |..^. |
+Server MAC key[20]:
+| 95 7c f3 a1 7a aa e2 18 7c 14 5d eb 44 de 1a 0e |.|..z...|.].D...|
+| 8a 57 0f 31 |.W.1 |
+Client Write key[16]:
+| 11 18 c5 bf 7e 5f bb 80 77 75 fd 33 6b 6e 72 b1 |....~_..wu.3knr.|
+Server Write key[16]:
+| 07 70 86 4b b1 1b 9b ae 7b da 46 f1 ee c2 e8 8f |.p.K....{.F.....|
+Client Write IV[16]:
+| 40 64 89 a4 db 02 a5 98 ec 83 72 a5 bb 31 a1 f2 |@d........r..1..|
+Server Write IV[16]:
+| 93 d5 7f 76 99 ec f0 49 4f 34 55 ac 31 de 9b 4e |...v...IO4U.1..N|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #218 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91ae...
+looking for RSA pre-master008098036d78af04b0df0adf81fd3d92912cfb41a1fd72f7...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..|
+| 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.|
+| 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...|
+| 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... |
+hash out[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+PRF out[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+key expansion[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+Client MAC key[20]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 |..0. |
+Server MAC key[20]:
+| ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a 28 58 15 6a |..u6....s...(X.j|
+| c9 8d a4 90 |.... |
+Client Write key[16]:
+| b2 d6 70 be b2 30 1a c6 4e d8 15 e0 d6 67 b7 8c |..p..0..N....g..|
+Server Write key[16]:
+| 4d 85 e0 53 35 84 95 4e 73 10 4d 3f 4a fc 2e ae |M..S5..Ns.M?J...|
+Client Write IV[16]:
+| c5 ae 50 0f f8 b1 f9 10 cc cd 68 1a 7f e7 09 5a |..P.......h....Z|
+Server Write IV[16]:
+| e0 00 51 bf 15 2b 12 bf f4 d3 a8 8e ab 53 46 db |..Q..+.......SF.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| da 1e 53 71 13 06 e0 4d 50 f4 f5 1e 8f 8b 4f 61 |..Sq...MP.....Oa|
+| a3 c6 75 18 d0 87 99 db 1a 5f 08 a9 b6 e9 f6 43 |..u......_.....C|
+| d9 d4 ef f2 73 f9 06 10 90 2c 8a a1 fe b9 48 b1 |....s....,....H.|
+| 36 48 2d 85 db b2 03 6a 22 30 bd d6 56 24 ea f5 |6H-....j"0..V$..|
+Plaintext[64]:
+| 34 6c 1c 72 2e c6 f9 f4 7b d1 c7 4c ce ac 42 0d |4l.r....{..L..B.|
+| 14 00 00 0c 62 68 8e 07 e3 e9 87 c4 64 4c ae 96 |....bh......dL..|
+| 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....|
+| 01 e1 50 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..P?............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....|
+| 01 e1 50 3f |..P? |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #219 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| de 04 09 48 bb 04 88 66 86 4f 28 a4 c4 98 58 02 |...H...f.O(...X.|
+| 3d 86 95 4a 9c a3 45 1e eb c4 27 9d 85 9a d6 b0 |=..J..E...'.....|
+| 4e cf c3 04 7d c0 1d 1a a1 0d e2 9f 72 a6 fa bb |N...}.......r...|
+| fe 60 f0 63 53 11 d6 bb a7 5d b4 be d7 dd ae 10 |.`.cS....]......|
+Plaintext[64]:
+| 60 fc 5d e4 11 09 ef 6f 85 b6 6e cd 0c a9 70 db |`.]....o..n...p.|
+| 14 00 00 0c a3 db ba fd 9c b7 bc e4 1d c6 6b ac |..............k.|
+| 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.|
+| c6 6d 9d 76 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.m.v............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.|
+| c6 6d 9d 76 |.m.v |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #220 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| f6 fe b7 9f c5 71 d6 09 31 21 97 31 71 2c ea 1e |.....q..1!.1q,..|
+| 46 d6 3b 94 19 f7 62 c3 5d 89 ee 1e aa e5 c8 03 |F.;...b.].......|
+| 3d 14 f5 36 4b 67 ef 79 fc 5b b5 e1 c2 0d eb bf |=..6Kg.y.[......|
+| 81 b3 9c 38 bb 8f af 7c 1c a2 06 de 1e 33 47 9a |...8...|.....3G.|
+| 3d ce d8 f7 ea f1 ff dc 88 76 b0 90 0c 46 8d bc |=........v...F..|
+| 7e c3 a1 5f 7c 0a 39 1d b2 07 ec 63 aa 66 d8 59 |~.._|.9....c.f.Y|
+| bf fb 7f 05 77 51 19 59 2d 4b aa 53 93 dd f6 73 |....wQ.Y-K.S...s|
+Plaintext[112]:
+| da bc 75 e8 e2 36 3a 4a 75 2d 01 cf ba 6a 95 58 |..u..6:Ju-...j.X|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 30 0d 0a 0d 0a 77 96 c7 8d e2 d2 15 e5 |4450....w.......|
+| 2d 77 c1 73 5e b2 37 5c d6 98 c4 28 03 03 03 03 |-w.s^.7\...(....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8b 17 28 9f f4 2e cf 5e f1 f4 29 db e2 ea b8 33 |..(....^..)....3|
+| fa d1 e7 58 |...X |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53394 found (nil)
+association_find: TCP port 4450 found 0x342de60
+
+dissect_ssl enter frame #221 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 85 90 11 f6 15 d2 7c 8b 27 50 90 40 d2 e9 4b 86 |......|.'P.@..K.|
+| f8 40 92 7b e3 cc fb b5 e6 75 61 61 fb a4 1f a0 |.@.{.....uaa....|
+| 44 8a be c2 f5 10 41 8b 53 81 8c 69 01 13 14 b5 |D.....A.S..i....|
+| d8 eb 77 35 e1 5c 9f 07 11 af 60 6e b3 55 55 e6 |..w5.\....`n.UU.|
+| 4d e4 6e ba 2c a9 ee 82 29 11 7c 94 94 e6 00 da |M.n.,...).|.....|
+| 4d 31 7e f8 1e 75 78 8d c4 dd 2b 39 eb 87 0b 6a |M1~..ux...+9...j|
+| 76 a1 5d aa 5f 30 b9 ef a7 61 95 74 f9 2c a0 0f |v.]._0...a.t.,..|
+| f3 ca b7 b1 55 6b d5 7d 4b 9d 15 48 c7 03 92 c8 |....Uk.}K..H....|
+| 2a 47 a4 fa c5 90 2a 19 df d4 e8 1b 21 6f 4f f5 |*G....*.....!oO.|
+| fc 75 01 57 94 d6 24 ae ba d2 56 99 16 ef f2 43 |.u.W..$...V....C|
+| ad c6 c2 fe ad 7b cf b2 30 1d ab 4c 1e 7b 01 d0 |.....{..0..L.{..|
+| f7 d7 d4 dd 0d 9d 3b a5 77 43 b3 f2 92 41 0f bc |......;.wC...A..|
+| 5c be c8 55 ee 53 2a cb 79 12 de b2 8b 95 9e f3 |\..U.S*.y.......|
+| cd c0 f4 1a a4 ad be 94 30 00 c0 fd 0f 34 c5 a8 |........0....4..|
+| 36 ea b8 f2 33 af 2e 5e 1e c4 45 30 59 22 db a3 |6...3..^..E0Y"..|
+| 75 da 27 c9 c1 6e 99 73 83 db 49 00 44 9e 81 7a |u.'..n.s..I.D..z|
+| b2 b4 55 6d 4d ba d6 08 c2 61 41 f4 76 ab c2 dd |..UmM....aA.v...|
+| 2a 32 a4 49 82 12 f3 43 eb 94 22 56 2a 12 78 a1 |*2.I...C.."V*.x.|
+| 38 ab fb c8 fb 7c 9d f6 15 62 e2 98 d8 e9 14 0d |8....|...b......|
+| ab 0a d6 dd db 7f cc 92 81 ab fb 36 3d 32 64 a5 |...........6=2d.|
+| a0 d4 99 4f c2 d9 5e 2a 69 80 ab 9f 3b 2c 69 2f |...O..^*i...;,i/|
+| eb 9b fc dd a4 b1 51 eb f8 cd fd 82 2d 12 cf 3f |......Q.....-..?|
+| db c5 ec af 29 2f 89 6e 84 1b f3 81 7e b5 42 0c |....)/.n....~.B.|
+| 28 d4 48 8a 56 ad 0a cb 53 1c 11 f7 dd 17 f5 33 |(.H.V...S......3|
+| ca 61 bb 25 e1 17 d4 54 be 6a 35 9d 06 61 3e c1 |.a.%...T.j5..a>.|
+Plaintext[400]:
+| 0d cd 43 22 4e ee 0e 02 2d 1a 62 80 89 7a 97 9b |..C"N...-.b..z..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R|
+| 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9a 78 5d db |nl'</script>.x].|
+| f5 ae 76 de ee 26 9b b1 fb df b3 42 94 8f 67 67 |..v..&.....B..gg|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bc 41 56 7d 9e 88 34 95 b0 3d 51 2b ad 81 89 3b |.AV}..4..=Q+...;|
+| 6f 02 89 b2 |o... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4450 found 0x342de60
+
+dissect_ssl enter frame #222 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 56 07 e5 3d a8 e5 e2 b7 82 32 98 51 b0 cd db 92 |V..=.....2.Q....|
+| 2e 71 94 4f 2c 50 48 f5 7c 00 e3 d6 53 ac ce 61 |.q.O,PH.|...S..a|
+| 32 c9 92 6a 9f 88 8e 81 0a fe 83 86 70 9b 87 4f |2..j........p..O|
+Plaintext[48]:
+| 6d fa 5a c7 06 29 98 f9 67 3a 23 41 64 47 1a b1 |m.Z..)..g:#AdG..|
+| 01 00 e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a |........3..$[49:|
+| 9e de e2 14 20 24 09 09 09 09 09 09 09 09 09 09 |.... $..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a 9e de |......3..$[49:..|
+| e2 14 20 24 |.. $ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #224 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 67 87 bf 08 17 6d a5 3e 16 71 61 9c ca bb 8c 3e |g....m.>.qa....>|
+| e7 99 6f c3 8d 4b 94 e7 db 4d e8 d0 17 c8 ce fe |..o..K...M......|
+| 00 aa ed e8 69 4a 6c ff a6 1e 58 e6 86 04 27 33 |....iJl...X...'3|
+Plaintext[48]:
+| c6 1e 1e 46 38 d7 d1 db 27 a5 9b bf 8d a9 61 08 |...F8...'.....a.|
+| 01 00 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 |..3...V\......q.|
+| 18 63 43 5f 7c 01 09 09 09 09 09 09 09 09 09 09 |.cC_|...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 18 63 |3...V\......q..c|
+| 43 5f 7c 01 |C_|. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #229 (first time)
+ssl_session_init: initializing ptr 0x7facc3832570 size 688
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45991 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4451
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #231 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+|
+| 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.|
+| 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*|
+| 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. |
+hash out[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+PRF out[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+key expansion[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+Client MAC key[20]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec |..<. |
+Server MAC key[20]:
+| 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd fe 19 46 0c |+x....v.e.....F.|
+| ef 8b e8 ad |.... |
+Client Write key[32]:
+| 7c 4f 97 74 31 57 f5 57 56 47 bc ef 4c c7 33 8e ||O.t1W.WVG..L.3.|
+| 92 f0 b6 6a 3b c7 ea 55 a8 aa 22 d0 26 cf 0c 08 |...j;..U..".&...|
+Server Write key[32]:
+| 01 13 48 92 c8 21 0a eb f9 8e 71 e5 1e 7d 6f 45 |..H..!....q..}oE|
+| 07 69 f9 2e 7e 6e 07 a4 f7 64 2e 37 7c 5f b3 c8 |.i..~n...d.7|_..|
+Client Write IV[16]:
+| ff 79 6e c4 8c 8b 77 88 af 92 1c 13 83 9c 43 75 |.yn...w.......Cu|
+Server Write IV[16]:
+| 3a ca a7 e2 49 a7 0b bb 52 f0 f8 09 aa 19 a5 43 |:...I...R......C|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #233 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a09...
+looking for RSA pre-master7c97fd12116f5cd9318ea3c2fd49a66dedcd1c3dd6580709...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+|
+| 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.|
+| 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*|
+| 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. |
+hash out[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+PRF out[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+key expansion[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+Client MAC key[20]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 |.-.6 |
+Server MAC key[20]:
+| 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c 8f 11 5c bb |9..#(..k.V.\..\.|
+| 27 8a 75 ae |'.u. |
+Client Write key[32]:
+| e5 21 ca ce 1b 2f 90 38 07 16 01 63 3c 91 ab 4a |.!.../.8...c<..J|
+| c4 82 b4 46 82 8b cc e2 53 21 62 af d0 8f aa fe |...F....S!b.....|
+Server Write key[32]:
+| 36 ba 16 c9 7b e9 2a b7 b7 80 d1 e2 1d 93 5f 44 |6...{.*......._D|
+| 79 a9 9e 3e 68 5c 89 3e cc 50 32 89 15 d4 99 26 |y..>h\.>.P2....&|
+Client Write IV[16]:
+| 08 c5 c8 26 75 f7 2a ed 24 ba 5f 03 57 b4 69 ba |...&u.*.$._.W.i.|
+Server Write IV[16]:
+| 0f 9d 74 ea d4 46 bb 51 6a b3 10 38 53 5b df 4d |..t..F.Qj..8S[.M|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8c 5f 0e c2 4f 0d dc 70 fa 81 64 3a 7f df 6f 8a |._..O..p..d:..o.|
+| 65 73 62 2a 29 20 d4 c0 f1 da c9 6f 5a 2a 28 4e |esb*) .....oZ*(N|
+| 73 01 d3 3c 23 a0 8d ce ac df 8a 15 6b 27 40 ff |s..<#.......k'@.|
+| fe 10 b0 d9 e2 d1 87 33 8c 11 84 4b 4b d2 5e a1 |.......3...KK.^.|
+Plaintext[64]:
+| a3 e6 4c 96 5b 0a db 17 31 13 95 cc f2 bc b5 d5 |..L.[...1.......|
+| 14 00 00 0c a8 bd 4b 1c 45 58 96 01 31 fc b9 72 |......K.EX..1..r|
+| 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....|
+| a7 59 ff 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Y.5............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....|
+| a7 59 ff 35 |.Y.5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #234 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| dc 75 bf d7 50 2f 48 80 b7 82 c3 2c 9b 6f f2 e3 |.u..P/H....,.o..|
+| 24 9f d6 90 8c 41 02 9c 33 6f 04 3e 10 a2 f2 90 |$....A..3o.>....|
+| 2a 2b ed 75 f9 3e 2f 17 4f 4b 72 fc ee 11 ce cc |*+.u.>/.OKr.....|
+| 8c b0 3a 57 7e aa 79 2b 34 bc 75 2a ff 0c 3f 21 |..:W~.y+4.u*..?!|
+Plaintext[64]:
+| a9 ff 4a 61 99 33 93 3c ee 55 f2 51 a6 1e 53 9c |..Ja.3.<.U.Q..S.|
+| 14 00 00 0c ff 37 53 48 fe fb 5f ef 96 28 b4 62 |.....7SH.._..(.b|
+| 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w|
+| 62 e4 e4 d8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |b...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w|
+| 62 e4 e4 d8 |b... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #235 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a9 ac 77 6a b9 49 cc 01 9e 99 52 80 0d c3 cd a9 |..wj.I....R.....|
+| d5 fe 73 b5 08 3b 39 9b 74 b2 db 0d 27 96 03 fa |..s..;9.t...'...|
+| e0 9e 07 37 fc 80 21 9b 6d bc d0 8a d2 8e d0 fb |...7..!.m.......|
+| c4 9a 33 3f be 1b 78 37 c9 fd cb 10 b7 85 26 12 |..3?..x7......&.|
+| 0a 72 19 84 27 7e fa 65 35 0c be 30 eb 96 eb c5 |.r..'~.e5..0....|
+| 8f 6e b2 72 84 89 d3 ef 1e 28 43 7d 7d f1 65 25 |.n.r.....(C}}.e%|
+| 44 fe 89 21 bb 84 11 ec 90 c8 43 d1 8b cf 49 3d |D..!......C...I=|
+Plaintext[112]:
+| 0d dc fe 87 9e 66 d3 86 a2 96 4e 92 2f e1 8f 4e |.....f....N./..N|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....|
+| 55 00 17 d7 9e 89 64 21 f1 d5 16 e3 54 8a a1 72 |U.....d!....T..r|
+| 6d ea 4e 84 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m.N.............|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 c7 49 3c 3f 3f 62 74 b0 97 4b 0c d1 15 9d 50 |3.I<??bt..K....P|
+| 9d f6 31 64 |..1d |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45991 found (nil)
+association_find: TCP port 4451 found 0x3424dc0
+
+dissect_ssl enter frame #236 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e1 4b 6e 39 13 f9 49 04 59 41 e0 f6 2a 8d 8c 36 |.Kn9..I.YA..*..6|
+| f6 34 82 31 f5 67 82 d1 f0 bf e8 2d 9d e2 96 24 |.4.1.g.....-...$|
+| e7 86 60 83 94 e0 7a d9 36 91 36 88 52 3a b7 b4 |..`...z.6.6.R:..|
+| 3f 9a 3f ce 7c 5d 7d d8 ae 73 74 72 6b 3f a4 04 |?.?.|]}..strk?..|
+| 95 28 1c af 38 82 84 2c 64 2d cc dc 32 10 78 d9 |.(..8..,d-..2.x.|
+| 02 90 bc 6a ce 5b 70 8c 61 4b d1 57 31 c2 e2 47 |...j.[p.aK.W1..G|
+| 07 36 ff 73 0f f9 cb 68 74 2d 42 41 b3 ab b7 97 |.6.s...ht-BA....|
+| 8c fe 86 b2 60 96 11 94 08 44 fc 8f 03 87 7d 23 |....`....D....}#|
+| ad e9 e0 10 21 2b a6 f8 ac 63 b9 0d 0b bd 63 3a |....!+...c....c:|
+| 22 2b 75 7e 9b 69 ff 79 e6 aa 7c 5a 1c 81 db c4 |"+u~.i.y..|Z....|
+| bc 75 27 d1 53 cb 63 fe b4 2a c1 2c 82 d0 ee 4c |.u'.S.c..*.,...L|
+| 16 40 0f e0 88 c7 34 43 2b 8e 64 ae bd fa 5a 36 |.@....4C+.d...Z6|
+| 15 b6 3f 5a 8a 99 f6 68 eb a9 b5 3a 5d 79 cf a5 |..?Z...h...:]y..|
+| 93 11 09 69 69 0c cf ff cc 17 e7 3a 3e 88 34 9e |...ii......:>.4.|
+| a3 98 c3 d0 5d dc e6 5f 31 12 64 76 f8 66 1d da |....].._1.dv.f..|
+| d0 e5 61 fd ef fd b4 b2 0e ff 6f 19 12 ab 8c f5 |..a.......o.....|
+| ba 63 97 50 d7 f4 34 63 9b be aa 7e 18 9b 8b f7 |.c.P..4c...~....|
+| 49 5a 73 bf 30 e2 6f 78 fb c4 fb 32 60 dc 0a 48 |IZs.0.ox...2`..H|
+| bb a5 64 17 43 25 37 70 dc 95 21 64 6d f4 41 48 |..d.C%7p..!dm.AH|
+| 66 c7 0b 01 cd d6 8b 40 96 63 16 52 64 53 84 38 |f......@.c.RdS.8|
+| 94 15 bc 95 a9 c0 00 2f a3 22 89 bf d0 da 89 02 |......./."......|
+| 7d de a7 cc 6c 1e c9 e2 18 1e 9d 79 0b ce fe 8c |}...l......y....|
+| da c7 74 e9 8a 14 f4 3e 64 bf 70 e2 5b 53 d1 92 |..t....>d.p.[S..|
+| 4c e9 a0 2b a5 ce 4c a3 e7 72 be 63 08 6c 4f 58 |L..+..L..r.c.lOX|
+| 2e 94 3a 8a 7b 92 f7 46 aa 47 e4 28 16 12 27 68 |..:.{..F.G.(..'h|
+Plaintext[400]:
+| fe 07 3e 92 d3 80 72 af 82 76 8c 41 23 45 c9 c5 |..>...r..v.A#E..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25|
+| 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e a2 05 fa 23 |nl'</script>...#|
+| a0 00 9c 53 8c 7e d3 dc 68 98 1b da 1b ec 58 43 |...S.~..h.....XC|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f9 f1 83 ba 77 40 95 49 8e 20 1e 75 be 14 e2 8c |....w@.I. .u....|
+| 6c 49 99 07 |lI.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4451 found 0x3424dc0
+
+dissect_ssl enter frame #237 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 78 26 87 b1 f9 e8 f1 33 20 91 34 02 00 78 4e 4a |x&.....3 .4..xNJ|
+| 91 3b 8b 17 91 de b0 cc fa c2 8c f5 1d 82 d1 a8 |.;..............|
+| d0 af b1 ba 6d a1 73 0f 51 f1 50 57 1c 94 6c 10 |....m.s.Q.PW..l.|
+Plaintext[48]:
+| 12 ec 43 b7 63 d8 9e 38 e7 c1 31 50 b9 22 a8 d3 |..C.c..8..1P."..|
+| 01 00 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f |..e...dV9@.%.k$/|
+| 1f b8 98 da 0f 76 09 09 09 09 09 09 09 09 09 09 |.....v..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f 1f b8 |e...dV9@.%.k$/..|
+| 98 da 0f 76 |...v |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #239 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4b e0 4c ca 1b c6 2a 79 38 d1 eb a9 fb 86 98 7f |K.L...*y8.......|
+| e0 a4 2a 34 60 a5 ba 3f c6 89 b6 d7 bc 61 48 f5 |..*4`..?.....aH.|
+| 05 bb e3 ea 75 ed 5d c8 a4 a0 38 68 62 d4 54 97 |....u.]...8hb.T.|
+Plaintext[48]:
+| d4 72 5e 93 4c 53 89 73 09 a8 0b 04 14 8d 12 c6 |.r^.LS.s........|
+| 01 00 cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 |....v...........|
+| a5 bf 7f 45 a1 19 09 09 09 09 09 09 09 09 09 09 |...E............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 a5 bf |..v.............|
+| 7f 45 a1 19 |.E.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #244 (first time)
+ssl_session_init: initializing ptr 0x7facc3834af0 size 688
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44935 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4452
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #246 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u|
+| 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.|
+| 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm|
+| 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... |
+hash out[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+PRF out[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+key expansion[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+Client MAC key[20]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 |C... |
+Server MAC key[20]:
+| 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 14 49 c8 c0 |O...?.fzt.B8.I..|
+| 63 b9 78 f6 |c.x. |
+Client Write key[32]:
+| 55 5b 32 fb 0f ef b9 7f 7c bd 10 ac 89 e5 16 75 |U[2.....|......u|
+| 27 f9 e6 ad 8a f4 07 f7 6c 2b e5 05 03 31 97 b6 |'.......l+...1..|
+Server Write key[32]:
+| 41 72 d3 2e 3c df 70 8d 57 a6 03 68 34 99 3e d8 |Ar..<.p.W..h4.>.|
+| d2 14 58 b2 0a 86 40 30 0a 11 4f ad 47 1c 23 33 |..X...@0..O.G.#3|
+Client Write IV[16]:
+| 7e a1 39 52 d0 fc 07 16 32 8a 8e 80 81 aa 11 15 |~.9R....2.......|
+Server Write IV[16]:
+| a0 89 d6 b5 2a 6c 8c 91 27 4b be af 69 fb 6e 33 |....*l..'K..i.n3|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #248 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a...
+looking for RSA pre-master0080a7f168aa7ed7d19030f70c424cdc8441875d8e56e5f3...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u|
+| 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.|
+| 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm|
+| 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... |
+hash out[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+PRF out[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+key expansion[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+Client MAC key[20]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d |.."] |
+Server MAC key[20]:
+| 88 89 c5 ed a4 f0 72 06 ab 12 60 68 31 73 9a f6 |......r...`h1s..|
+| b7 1c b6 2b |...+ |
+Client Write key[32]:
+| 48 f1 89 95 81 bd ea d9 9b 62 1b f9 ea df c6 d3 |H........b......|
+| 7b 90 77 29 6f 4e 56 52 b7 98 d8 22 73 e7 34 40 |{.w)oNVR..."s.4@|
+Server Write key[32]:
+| 1f 91 c7 68 07 5d 1c e5 ba 67 36 80 83 17 42 1d |...h.]...g6...B.|
+| c8 aa d8 87 07 86 60 64 a7 ef de cc f0 96 02 06 |......`d........|
+Client Write IV[16]:
+| 4f 23 f4 a5 d5 d3 d9 32 40 78 25 1a 10 07 55 1f |O#.....2@x%...U.|
+Server Write IV[16]:
+| 4d 90 9a f2 c1 2f fd ad 5c 6c 71 bc d6 2b 87 8f |M..../..\lq..+..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 75 ec a8 08 8d 09 8e 87 a8 98 7b 51 25 1b ae 82 |u.........{Q%...|
+| e2 a6 b2 5d f6 32 6b fe f8 ac 26 ac c4 56 31 11 |...].2k...&..V1.|
+| 39 84 98 44 2b d7 5d b6 fa 69 c1 d4 6b cb 3d c0 |9..D+.]..i..k.=.|
+| d8 6b 33 b8 44 82 ea 29 a3 c4 c1 97 5c 3f 29 9a |.k3.D..)....\?).|
+Plaintext[64]:
+| 7c 31 75 5d eb 2c ae f4 03 be 09 1e 27 1e 34 a1 ||1u].,......'.4.|
+| 14 00 00 0c 4c 70 79 30 7d 62 93 b9 aa a7 5f 06 |....Lpy0}b...._.|
+| 4e d4 1c 57 83 4a 6d 82 1c 29 30 cc 8d 7b 32 0e |N..W.Jm..)0..{2.|
+| 39 a5 e0 81 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |9...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e d4 1c 57 83 4a 6d 82 1c 29 30 cc 8d 7b 32 0e |N..W.Jm..)0..{2.|
+| 39 a5 e0 81 |9... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #249 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 38 2e 86 e7 be b4 97 c9 14 35 55 8e 1a 55 5b 09 |8........5U..U[.|
+| 22 5d 71 76 41 ce 1e fe 5f 63 3d 29 75 b3 7b 4f |"]qvA..._c=)u.{O|
+| 23 90 a1 7a f2 19 20 db 1f 3b 6f c6 6b 8c f8 47 |#..z.. ..;o.k..G|
+| 71 29 3d 42 b4 f5 17 2e 49 c5 e8 5e e5 a9 62 2e |q)=B....I..^..b.|
+Plaintext[64]:
+| 3f 01 11 a1 3f 61 78 54 aa 7c b8 be 12 da fb 02 |?...?axT.|......|
+| 14 00 00 0c e4 9f 8d b2 d5 96 3c c5 43 84 29 fc |..........<.C.).|
+| 01 ef 6e ca 80 60 7a cb 37 97 ca 54 95 a4 f3 6f |..n..`z.7..T...o|
+| 6e fd c9 e5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |n...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 01 ef 6e ca 80 60 7a cb 37 97 ca 54 95 a4 f3 6f |..n..`z.7..T...o|
+| 6e fd c9 e5 |n... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #250 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a7 d1 79 03 e0 60 6c 8b 88 f0 09 db 2f 23 16 25 |..y..`l...../#.%|
+| e4 84 0d b2 8a 6a d3 e0 b6 aa be 5f 1c f4 b7 8c |.....j....._....|
+| ec e5 6a 55 39 4c fc 25 05 da e9 e4 d1 14 bf a2 |..jU9L.%........|
+| 0d f9 6e 1a a1 96 ea 3f 51 6f b9 74 ba b3 d3 2b |..n....?Qo.t...+|
+| a3 ff d5 73 53 b9 d9 14 a4 d5 13 23 56 17 3c d4 |...sS......#V.<.|
+| 88 e3 50 a6 e2 fd 32 36 2b e7 3a c1 09 b8 3b 4f |..P...26+.:...;O|
+| 72 8d 0f c7 f3 05 be 1f a6 4b f5 6f d5 b3 0d 9f |r........K.o....|
+Plaintext[112]:
+| f9 72 0c c3 30 cc 1a 85 4e ab 61 7c d0 1b 23 18 |.r..0...N.a|..#.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 32 0d 0a 0d 0a d7 a0 6a fb 98 3c ab 7d |4452......j..<.}|
+| 58 18 26 01 f1 a9 46 5f f5 22 9e 3a 03 03 03 03 |X.&...F_.".:....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e f2 5c ad ee da 26 50 45 65 0a 80 cc 99 2f fd |>.\...&PEe..../.|
+| e3 76 ab 8f |.v.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44935 found (nil)
+association_find: TCP port 4452 found 0x3425580
+
+dissect_ssl enter frame #251 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 07 25 c2 b9 e3 c5 07 31 5d 7e 76 d2 35 df a7 27 |.%.....1]~v.5..'|
+| 79 f5 62 56 fa 8e 9b 7e 73 03 c1 b0 15 55 5e 39 |y.bV...~s....U^9|
+| 38 3b 16 78 a1 88 da fe 33 48 6e ac df 30 34 ce |8;.x....3Hn..04.|
+| 18 b2 c4 83 4a b0 e6 67 2e 20 2a d9 25 75 fb 17 |....J..g. *.%u..|
+| 85 ea 08 af 6f 3d ae cd e4 50 a2 e1 d5 0a 59 c3 |....o=...P....Y.|
+| c8 3d af e6 1d 70 eb 6f 41 ca 32 57 a6 53 f4 86 |.=...p.oA.2W.S..|
+| 4b 7f ae 77 55 cc 68 c2 cb 22 e0 4a 13 d8 e8 dc |K..wU.h..".J....|
+| d4 95 63 8c 69 19 91 94 48 da f7 65 3c ed b5 03 |..c.i...H..e<...|
+| 86 c6 fc e0 6c fb b0 70 85 9e e7 14 aa ed dc 49 |....l..p.......I|
+| 61 75 88 ff 72 a1 2c 6e 69 47 5d 92 2e 0a 9e 0a |au..r.,niG].....|
+| fb a1 da e5 d4 9c 36 a0 3b 8d 23 2c 12 68 a2 85 |......6.;.#,.h..|
+| 02 b5 99 26 9a 66 9b c0 01 1b 8b a6 e5 13 94 88 |...&.f..........|
+| 0a 75 fa 61 8d da e0 a9 41 47 a3 0e 2b 18 f2 2f |.u.a....AG..+../|
+| c8 93 2f 68 99 37 8d 72 bc 99 ab e9 df 80 55 ba |../h.7.r......U.|
+| 05 14 dd ba 41 b2 66 a5 8a 24 f5 99 2b f3 c9 8f |....A.f..$..+...|
+| 4b 45 d3 0c 55 2b 6e a3 93 7b 0a db 96 86 34 7f |KE..U+n..{....4.|
+| 37 bc 50 d8 15 34 47 61 9c 75 af a8 5b 5d ab 5b |7.P..4Ga.u..[].[|
+| 1e cb 9a 04 49 e6 3b 53 12 fa 21 25 7d b9 2f 68 |....I.;S..!%}./h|
+| da ae 3a e5 20 8b d6 49 47 ca c9 45 c4 3b 9f 9c |..:. ..IG..E.;..|
+| 43 c0 01 9f 8f 11 39 b1 5a 3c 89 2e de 09 4e 65 |C.....9.Z<....Ne|
+| ce aa d4 4b 4b 02 8a a5 3a 0d 68 20 8c 09 22 b6 |...KK...:.h ..".|
+| 92 67 d5 74 03 10 63 4d 15 6d a0 ed fa 5c 55 bc |.g.t..cM.m...\U.|
+| da ea 35 05 44 7e 28 36 1a 0c d7 8e 73 2c 25 de |..5.D~(6....s,%.|
+| ec 81 ff 06 5a 4a 82 de 08 5a 80 93 91 75 e0 fd |....ZJ...Z...u..|
+| c3 67 a5 ce 08 43 a4 db ce 1d 09 78 6f 87 a7 96 |.g...C.....xo...|
+Plaintext[400]:
+| 3e 38 79 cc e8 37 06 2d 17 6a 2d 3d b3 bf 24 46 |>8y..7.-.j-=..$F|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D|
+| 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 81 6e 9d ae |nl'</script>.n..|
+| 14 ca ec 62 1a b2 1a a6 a0 62 21 bc 50 63 81 16 |...b.....b!.Pc..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 14 66 d1 03 82 dd 26 c5 2f 30 f1 f2 86 8e e5 82 |.f....&./0......|
+| 30 1e 81 e9 |0... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4452 found 0x3425580
+
+dissect_ssl enter frame #252 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f6 4a 3f 4c 1d d6 d3 2c fe 8e 4f 8f 4c 31 52 5e |.J?L...,..O.L1R^|
+| 8a 53 bb 66 b4 2c 1b a2 f9 56 3c e5 68 8e 88 25 |.S.f.,...V<.h..%|
+| be 47 a4 bc f0 e4 99 61 67 03 50 f6 d5 8b 2c c1 |.G.....ag.P...,.|
+Plaintext[48]:
+| 08 4c cf cb 75 b3 56 cb 0f c5 f9 44 13 87 bd 8c |.L..u.V....D....|
+| 01 00 b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e |.....M...l.%....|
+| 85 f6 67 9a 38 75 09 09 09 09 09 09 09 09 09 09 |..g.8u..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e 85 f6 |...M...l.%......|
+| 67 9a 38 75 |g.8u |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #254 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9a 35 0b d6 e7 5b 20 4c 59 dd 07 48 cb b1 49 6f |.5...[ LY..H..Io|
+| 54 bc fd 71 99 d8 f6 92 5b 7f 0f 1a b7 8d c3 4b |T..q....[......K|
+| bd d3 84 e0 95 dc 0d e2 3f 86 8d 69 f5 5a 82 59 |........?..i.Z.Y|
+Plaintext[48]:
+| 51 02 c2 5e ff 54 55 ff de 55 11 c8 1d 7c 9a 09 |Q..^.TU..U...|..|
+| 01 00 f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 |.....Y..u8.|<.KA|
+| e9 91 92 e7 fa 51 09 09 09 09 09 09 09 09 09 09 |.....Q..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 e9 91 |...Y..u8.|<.KA..|
+| 92 e7 fa 51 |...Q |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #259 (first time)
+ssl_session_init: initializing ptr 0x7facc3837030 size 688
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52817 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4453
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #261 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..|
+| 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.|
+| 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*|
+| 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... |
+hash out[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+PRF out[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+key expansion[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+Client MAC key[20]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 |.Y.. |
+Server MAC key[20]:
+| 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 22 37 8a 74 |.....W...u.'"7.t|
+| 37 cd 58 77 |7.Xw |
+Client Write key[32]:
+| cd da 50 dd 9f c1 25 35 ee c7 62 fd 60 b0 42 53 |..P...%5..b.`.BS|
+| 51 25 4d 1e f5 53 0b 9f db f1 9c fd 5d 71 6d 82 |Q%M..S......]qm.|
+Server Write key[32]:
+| 22 8e 83 c8 70 0f 43 e9 a2 85 08 25 82 52 93 72 |"...p.C....%.R.r|
+| 07 6b 3c 79 1a 9e 77 79 f0 c2 6b 62 5e 01 bf 94 |.k<y..wy..kb^...|
+Client Write IV[16]:
+| 8d c0 ba a0 95 35 3c 4f d6 96 33 87 ff 92 e0 78 |.....5<O..3....x|
+Server Write IV[16]:
+| 1e 6c 14 47 c9 cc 10 17 af a9 91 59 0f d2 30 6e |.l.G.......Y..0n|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #263 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67...
+looking for RSA pre-master0080a34aa68a1ab4c3cf96ca5afc9a068e82cadf846fb144...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..|
+| 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.|
+| 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*|
+| 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... |
+hash out[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+PRF out[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+key expansion[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+Client MAC key[20]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 |...! |
+Server MAC key[20]:
+| 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 75 22 5a 3b |.nm...3[....u"Z;|
+| 72 fc dd 11 |r... |
+Client Write key[32]:
+| d9 90 b0 18 52 4f 80 e0 f2 31 97 a7 cb ce 65 9f |....RO...1....e.|
+| e5 32 7c 31 b4 a5 0f fb eb b1 3f 58 98 20 86 72 |.2|1......?X. .r|
+Server Write key[32]:
+| 1f 9b ed ea 9e 28 4c 76 61 2c 96 75 57 c9 c8 3e |.....(Lva,.uW..>|
+| 01 10 2f d9 7b 52 48 f2 9c cf a2 75 eb c3 48 fe |../.{RH....u..H.|
+Client Write IV[16]:
+| df c2 e0 65 cc d5 1b 7d 41 90 f2 cc 91 c3 a2 19 |...e...}A.......|
+Server Write IV[16]:
+| ef cb eb c3 66 14 5f 48 27 84 d2 b3 94 79 87 ce |....f._H'....y..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f9 cd f8 0e 2a 35 1c 38 46 b8 97 ee d0 2d ad 13 |....*5.8F....-..|
+| 64 bf 9d db bc 38 b3 28 89 4d 91 61 37 9c 4d f1 |d....8.(.M.a7.M.|
+| 60 97 d3 e8 30 61 8d 4f 41 6e 25 ed 6f 7e 06 10 |`...0a.OAn%.o~..|
+| 82 25 58 bd 33 a9 83 0f ce ac 88 f7 fb d2 19 72 |.%X.3..........r|
+Plaintext[64]:
+| d8 db 31 5a 45 68 02 52 59 02 8d 8c 6b b4 e0 f5 |..1ZEh.RY...k...|
+| 14 00 00 0c d8 a7 bc e3 c6 f1 50 8b 6f 2c 9e f6 |..........P.o,..|
+| 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.|
+| 75 e6 8c 93 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |u...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.|
+| 75 e6 8c 93 |u... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #264 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1c e7 46 55 44 95 2c e0 54 e3 9a 5f 49 d7 29 28 |..FUD.,.T.._I.)(|
+| f4 a9 a5 cd ee a9 1d 6f 00 a3 9e c5 fa 99 8d 85 |.......o........|
+| 73 3b e9 84 48 a3 85 d7 d6 61 4c be fe 6f 6e 35 |s;..H....aL..on5|
+| 34 30 b3 c9 b2 0c 4e 96 ca 1d ad a3 dd a9 21 dd |40....N.......!.|
+Plaintext[64]:
+| c2 a4 95 cb 42 16 52 56 6b ab 48 02 63 36 6a d9 |....B.RVk.H.c6j.|
+| 14 00 00 0c 9b ca bc 2d 37 c6 5e f6 7a 33 71 e8 |.......-7.^.z3q.|
+| 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.|
+| af 01 59 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..Y?............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.|
+| af 01 59 3f |..Y? |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #265 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 1e ab cc b1 b6 4c d0 fb f9 84 f6 6d 1e 43 80 d7 |.....L.....m.C..|
+| c7 06 39 3e 38 de c6 38 9e 31 69 b6 1d e9 4e 2e |..9>8..8.1i...N.|
+| c1 7a 67 e1 19 7b 3f d8 92 21 f7 3c 30 85 c4 ff |.zg..{?..!.<0...|
+| 85 08 1a 5e 3d bf 8e 49 e3 b6 1f 6d f9 50 fe 99 |...^=..I...m.P..|
+| 9c b6 d4 c7 b6 81 2b 92 0f aa f6 b8 09 a8 03 0e |......+.........|
+| 7b 1a 02 9d 04 08 c0 10 2c 2a 0c 05 12 be 1c bb |{.......,*......|
+| c8 6c 83 7c 4a c6 7b ca 14 ee 7d 86 fe ea c0 f8 |.l.|J.{...}.....|
+Plaintext[112]:
+| a6 54 42 d0 c7 bf 33 a3 9c 3e dc 31 3d 40 bf ad |.TB...3..>.1=@..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 33 0d 0a 0d 0a 94 27 43 3c 34 7e 07 8b |4453.....'C<4~..|
+| a5 94 3d 0b ba f1 82 54 d5 0d 3a 21 03 03 03 03 |..=....T..:!....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 f9 9a f8 88 2f 31 15 24 07 80 a3 88 1b 23 b0 |%..../1.$.....#.|
+| 17 c4 76 f2 |..v. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52817 found (nil)
+association_find: TCP port 4453 found 0x3425530
+
+dissect_ssl enter frame #266 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| cb 1e 48 31 e7 63 1e 7f 99 78 23 80 2e 9a c3 3d |..H1.c...x#....=|
+| 9a 74 54 80 bc 1e 6d e5 8e ce 3a 2e 28 6b 3c 27 |.tT...m...:.(k<'|
+| 09 6c 99 07 c8 f9 63 84 53 b7 cb 7d 64 3f 04 dc |.l....c.S..}d?..|
+| ef 09 a3 9f 52 c8 dd a3 03 50 d9 d9 93 fa 19 0a |....R....P......|
+| a7 02 15 6c 44 43 62 c6 73 6b 5c 18 c0 3d 1c ce |...lDCb.sk\..=..|
+| db 41 fa 80 2f 78 f4 3f 16 74 e4 0f 05 12 4c d3 |.A../x.?.t....L.|
+| 4f 18 12 12 70 14 83 13 e2 4d 45 bd fe 7b 8b 03 |O...p....ME..{..|
+| 00 d6 8c 28 9a ec e8 9e 3f 76 0a df 98 0e 02 88 |...(....?v......|
+| fc 12 df 72 5f b3 85 5b 46 90 9d 84 72 58 cf 0e |...r_..[F...rX..|
+| 6f 25 ff 40 16 eb 8d 6b 44 e1 d3 0b 55 83 a5 0f |o%.@...kD...U...|
+| 14 d0 bd 0e b4 a2 45 a2 a9 31 58 05 76 c8 8e 47 |......E..1X.v..G|
+| 71 6c b0 e6 87 7f 11 77 c8 fd 19 f7 9a c1 ef b7 |ql.....w........|
+| 2c f1 05 83 f0 85 d0 a7 91 10 b5 1f 0c 54 4a 90 |,............TJ.|
+| 5c 6e bb c6 2e a7 d4 7a d6 a2 ce 23 5d 65 ab c5 |\n.....z...#]e..|
+| c2 fd 82 b0 2b de d6 86 22 c8 47 04 cf 23 8f e2 |....+...".G..#..|
+| de c2 5c 42 91 38 7b 4f 92 83 ef a6 b7 f7 62 22 |..\B.8{O......b"|
+| 6d 5a 0c bc 69 fa be 94 bf da 04 a8 7d e8 ea 37 |mZ..i.......}..7|
+| ef 91 d9 3f 50 e9 0c 15 d9 86 9b 1f ca 23 f1 5d |...?P........#.]|
+| e8 b2 31 64 11 00 db 65 7e 6b 03 6b 5d db 86 bc |..1d...e~k.k]...|
+| 43 62 cb af c2 7b e7 cb 09 1f 2e 76 e2 c3 7f 9a |Cb...{.....v....|
+| 0b 6a 81 99 83 c5 90 8d 8b 44 b7 87 4c 48 f5 ba |.j.......D..LH..|
+| 27 8d e1 ee 51 f8 28 50 36 05 02 99 26 cb 5a 26 |'...Q.(P6...&.Z&|
+| ac 21 a5 cb 75 11 d8 10 cf ee 12 31 b8 fe 1b 74 |.!..u......1...t|
+| 85 ae 19 32 9e 31 af a8 6f be 2d e9 6b 78 90 e5 |...2.1..o.-.kx..|
+| 51 b6 5b dd fa e8 7a dc 45 c8 29 75 f3 10 74 17 |Q.[...z.E.)u..t.|
+Plaintext[400]:
+| 78 b9 b9 b5 43 4a a2 10 2b 58 5d b4 0d 45 73 ab |x...CJ..+X]..Es.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R|
+| 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 84 88 3a 81 |nl'</script>..:.|
+| 34 a6 10 78 7a ae 78 fb 12 7e c3 79 18 c9 78 71 |4..xz.x..~.y..xq|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 61 90 93 11 23 77 13 ea a4 e9 b0 1f a3 bc 51 |.a...#w........Q|
+| 78 a2 17 80 |x... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4453 found 0x3425530
+
+dissect_ssl enter frame #267 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4e 95 cc 52 06 b4 4c 17 89 3a 8c 81 42 34 23 52 |N..R..L..:..B4#R|
+| 22 67 92 51 c5 fc be 40 0f a1 22 b0 d5 59 d2 c7 |"g.Q...@.."..Y..|
+| 4b 2b 16 d4 59 0a 38 9c 51 b8 6d 86 af a6 b9 22 |K+..Y.8.Q.m...."|
+Plaintext[48]:
+| 9e c3 0d 82 a9 67 6b 4d a5 4e 0c f5 40 9a 8f 12 |.....gkM.N..@...|
+| 01 00 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 |..7..d..Vc.p...I|
+| 99 87 66 a0 c6 d1 09 09 09 09 09 09 09 09 09 09 |..f.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 99 87 |7..d..Vc.p...I..|
+| 66 a0 c6 d1 |f... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #269 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2c a4 58 8b 8b 93 11 d3 3d 11 6b 35 42 be d7 52 |,.X.....=.k5B..R|
+| 33 27 b3 a3 3e de 83 f0 a8 e1 53 dc 9b c0 d4 71 |3'..>.....S....q|
+| 53 72 b8 fb 87 5d d1 7e 61 01 b3 41 c0 5d 56 3f |Sr...].~a..A.]V?|
+Plaintext[48]:
+| ff 5e e5 02 7a c0 2e 50 99 54 67 49 c2 35 6d 14 |.^..z..P.TgI.5m.|
+| 01 00 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b |..N..Q/#.R.."T.+|
+| 5b 9f 0b ac 53 8b 09 09 09 09 09 09 09 09 09 09 |[...S...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b 5b 9f |N..Q/#.R.."T.+[.|
+| 0b ac 53 8b |..S. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #274 (first time)
+ssl_session_init: initializing ptr 0x7facc3839530 size 688
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50333 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4457
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #276 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&|
+| a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.|
+| 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;|
+| 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. |
+hash out[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+PRF out[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+key expansion[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+Client MAC key[20]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 |..J8 |
+Server MAC key[20]:
+| b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f 89 44 4a 98 |..KU.X.:U-...DJ.|
+| db ad 27 69 |..'i |
+Client Write key[16]:
+| 62 d8 46 48 48 fa c3 98 43 81 83 58 fb df 64 e2 |b.FHH...C..X..d.|
+Server Write key[16]:
+| a2 26 cc 21 7e 20 1b 04 81 ad 69 c5 bf 1b 86 c5 |.&.!~ ....i.....|
+Client Write IV[16]:
+| 89 0b 05 b8 1b f3 f7 2f fa c6 98 1e 9c 4d 4c 68 |......./.....MLh|
+Server Write IV[16]:
+| 1c 61 a2 49 5a b2 90 2f fd 63 2a d8 4d 83 95 58 |.a.IZ../.c*.M..X|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #278 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6...
+looking for RSA pre-master49b0d526ec1cca1e189791ee6237d54b6d7a53ba163b9e3c...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&|
+| a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.|
+| 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;|
+| 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. |
+hash out[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+PRF out[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+key expansion[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+Client MAC key[20]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 |.|.Y |
+Server MAC key[20]:
+| 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 ba 32 ac 6d |5./....A.....2.m|
+| 01 8a 04 61 |...a |
+Client Write key[16]:
+| 4f 32 41 e7 55 47 90 32 66 e4 0b 57 ed d6 3d b0 |O2A.UG.2f..W..=.|
+Server Write key[16]:
+| e6 5e 04 6b c0 3f b5 c3 92 8e 62 c3 41 36 35 69 |.^.k.?....b.A65i|
+Client Write IV[16]:
+| 70 1b 35 77 16 97 09 d5 9b bb 8f 8a 97 4d ec 20 |p.5w.........M. |
+Server Write IV[16]:
+| 4e 96 94 6c 84 a7 85 7a bb d4 14 ff 4f c3 ad f2 |N..l...z....O...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b1 dc 9b 8b 30 62 dc 3c 73 65 7d 43 aa aa ed 69 |....0b.<se}C...i|
+| 7f 78 38 e3 b7 dc 7c b9 b1 c0 e2 8a 88 7b b9 d2 |.x8...|......{..|
+| bf 9a 79 78 27 45 55 16 ab 1c 90 0c 58 f9 6e a2 |..yx'EU.....X.n.|
+| e1 db c0 93 38 8e f0 84 dc 14 9a 74 2a ef 00 8d |....8......t*...|
+Plaintext[64]:
+| 9c 5e 9a a2 97 8a 97 b1 82 74 11 37 7c fc 4d cb |.^.......t.7|.M.|
+| 14 00 00 0c 5e bb 06 48 45 bf 04 0d bd 2e 9d 16 |....^..HE.......|
+| 3d f5 e0 35 e2 51 7a c5 67 6d ea 23 e1 29 5f 4c |=..5.Qz.gm.#.)_L|
+| a2 2c 58 df 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,X.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3d f5 e0 35 e2 51 7a c5 67 6d ea 23 e1 29 5f 4c |=..5.Qz.gm.#.)_L|
+| a2 2c 58 df |.,X. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #279 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 71 f8 9b 7a 5e 11 bb 24 38 93 87 db f1 2a dc 52 |q..z^..$8....*.R|
+| 5c 42 93 e9 1f 17 7d 49 8d ec a3 ad 98 25 40 01 |\B....}I.....%@.|
+| 59 a4 ed d0 10 3c f1 69 c8 78 a5 8d c4 ea e3 9b |Y....<.i.x......|
+| b6 88 46 90 cf 0e 6f 34 dc 6b ea df a9 53 70 3e |..F...o4.k...Sp>|
+Plaintext[64]:
+| 4c ca d8 e5 92 a5 96 fb 1d 54 52 e6 fd c1 06 64 |L........TR....d|
+| 14 00 00 0c 61 42 f8 38 c7 91 5d 72 b6 74 92 dc |....aB.8..]r.t..|
+| 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.|
+| a1 15 70 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..p.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.|
+| a1 15 70 9d |..p. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #280 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 73 db 77 89 e3 a7 c9 fb 53 48 d3 2a 85 71 79 da |s.w.....SH.*.qy.|
+| f3 5b e0 ab d0 f7 a0 5d d2 43 06 6f 3c 01 9a c1 |.[.....].C.o<...|
+| 79 ba 05 f1 a0 67 3d 23 69 18 9c 2b 70 94 71 1c |y....g=#i..+p.q.|
+| 8d f4 25 e2 03 13 f4 91 e2 8c c1 46 43 1b ad a6 |..%........FC...|
+| 25 88 44 89 05 55 11 e8 be 9a b7 5b 72 48 2e a7 |%.D..U.....[rH..|
+| b9 a5 a6 6d dc 81 0f 09 45 ca 2c c2 c3 f0 b2 b8 |...m....E.,.....|
+| 87 8c 4c c6 a7 fe 6d 03 a0 fe 5e 6d 0b 80 08 14 |..L...m...^m....|
+Plaintext[112]:
+| 59 db 8a 5f e8 a2 a8 e7 ad 17 00 35 cd ef 3a 69 |Y.._.......5..:i|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12|
+| 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445|
+| 37 0d 0a 0d 0a 22 2d a5 65 9f 4f 66 55 39 1a 50 |7...."-.e.OfU9.P|
+| e1 09 71 ac 14 55 3d 43 4b 06 06 06 06 06 06 06 |..q..U=CK.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 10 58 a5 55 ab da cd ab 83 64 d5 c0 12 d4 df 14 |.X.U.....d......|
+| 01 a0 fa 18 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50333 found (nil)
+association_find: TCP port 4457 found 0x3425860
+
+dissect_ssl enter frame #281 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 45 ec 2f af ab d8 64 59 62 19 e5 db 53 fd ab 59 |E./...dYb...S..Y|
+| c7 41 de 02 e9 9f 13 49 f3 7b 96 54 89 84 04 57 |.A.....I.{.T...W|
+| 0b b3 b4 99 7e 7e 8b 85 47 41 e7 0f 82 a9 d9 81 |....~~..GA......|
+| a1 10 f0 12 66 13 07 5f 17 64 12 80 b2 d1 aa 64 |....f.._.d.....d|
+| 87 9f 8c 63 f0 c3 d9 67 b0 e7 a2 3d 7d f7 86 4c |...c...g...=}..L|
+| a4 62 10 f4 46 67 53 19 14 ea 31 14 1a cd be a5 |.b..FgS...1.....|
+| fd 30 ec 60 31 4e 95 a6 1e 5c 4d c7 5a 5f 7c de |.0.`1N...\M.Z_|.|
+| 80 de b2 9a 93 c9 96 e8 76 95 1b 18 cb 95 e9 80 |........v.......|
+| 3b c7 78 11 14 45 90 42 42 44 19 bc 9f 5e 17 6b |;.x..E.BBD...^.k|
+| 56 06 de d4 52 c4 50 4e 2f 4b 8a 0e 24 b9 72 c0 |V...R.PN/K..$.r.|
+| 9b 03 d2 4f a8 3e 15 4c b4 58 8f 74 58 bb 2f 16 |...O.>.L.X.tX./.|
+| a0 6f 68 7d dd 15 89 37 9e 67 3a e0 84 a8 92 cd |.oh}...7.g:.....|
+| b8 1f 8c 7b d8 ec 8a ff 88 83 a6 bc 64 2a aa 08 |...{........d*..|
+| e5 54 1b 03 d9 2e 20 3e ca 17 03 51 0d ae 2e 7f |.T.... >...Q....|
+| d3 d1 df 7d 9e 98 1f 3d 14 51 ba c2 67 69 c6 8e |...}...=.Q..gi..|
+| 71 3e f6 01 06 4e 3a 16 47 27 f7 52 07 fb 01 ae |q>...N:.G'.R....|
+| eb 09 64 33 49 05 0e f3 33 1f 07 5b aa 2b 14 de |..d3I...3..[.+..|
+| f7 95 a2 c6 f1 8a a3 41 5e 25 3b be 59 b8 6d 4d |.......A^%;.Y.mM|
+| 88 91 77 e9 44 ab 6a 60 14 09 c9 0b 7f 60 9d 8c |..w.D.j`.....`..|
+| 1e c5 07 c6 9d 29 60 1f 6a 0a 93 dc 2e 14 f9 c3 |.....)`.j.......|
+| 5b 9f bf 36 59 44 25 09 e6 12 89 74 93 44 51 1a |[..6YD%....t.DQ.|
+| 00 34 af 2c 79 36 a5 08 6b 55 de 83 a0 ca cf 62 |.4.,y6..kU.....b|
+| f2 a2 9a 76 94 4b ed 96 34 5d 54 51 82 d9 9b 2b |...v.K..4]TQ...+|
+| 3a 1a 2e 2a 06 ec 48 50 ea 5f a4 2a 5f fd e1 f3 |:..*..HP._.*_...|
+| 1a ad f2 dc 1c ff 33 8c 68 f2 3d 95 ba e6 bc ac |......3.h.=.....|
+Plaintext[400]:
+| 9a c6 14 70 ac 6f a4 c0 1f c0 e8 49 a0 b9 99 b5 |...p.o.....I....|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL|
+| 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 7f 41 57 03 d3 08 fd 78 86 2b aa 3a b5 57 5e 78 |.AW....x.+.:.W^x|
+| 7d 5a 42 00 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |}ZB.............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 21 c6 d6 7a 18 f5 c7 4e cf 09 55 6b e0 e1 f1 a4 |!..z...N..Uk....|
+| 8b be e0 c5 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4457 found 0x3425860
+
+dissect_ssl enter frame #282 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 96 2c ce 53 2f df 3a cf 80 7e f0 f3 0e c5 48 eb |.,.S/.:..~....H.|
+| 58 26 21 2e b2 a2 78 e8 9a d4 be da fe d5 e1 9b |X&!...x.........|
+| 1c cb 21 4d 24 8f fc b5 1d dd 8f 6a 54 ba cd 98 |..!M$......jT...|
+Plaintext[48]:
+| 7b 05 0a ea 9a e5 6e e4 4d 05 35 38 59 b9 57 b7 |{.....n.M.58Y.W.|
+| 01 00 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b |......e....qq.0.|
+| f8 d5 21 8a 4b 7b 09 09 09 09 09 09 09 09 09 09 |..!.K{..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b f8 d5 |....e....qq.0...|
+| 21 8a 4b 7b |!.K{ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #284 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c3 77 31 8c 96 9d 3b 7c bf d8 24 fb a1 70 d4 a5 |.w1...;|..$..p..|
+| a0 b9 a5 5f 1e f9 1c a6 14 f1 f0 6f 05 dc eb ff |..._.......o....|
+| aa f3 aa da 25 41 1c 89 7f 9c 91 f3 cd cd aa 55 |....%A.........U|
+Plaintext[48]:
+| 64 cc 71 81 da 80 c2 c1 4b 7c e6 d9 f9 26 09 3e |d.q.....K|...&.>|
+| 01 00 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f |...pn_TF.1/....?|
+| 7c 4a 10 ee 54 13 09 09 09 09 09 09 09 09 09 09 ||J..T...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f 7c 4a |.pn_TF.1/....?|J|
+| 10 ee 54 13 |..T. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #289 (first time)
+ssl_session_init: initializing ptr 0x7facc383baf0 size 688
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44746 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4458
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #291 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..|
+| 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.|
+| 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..|
+| ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. |
+hash out[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+PRF out[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+key expansion[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+Client MAC key[20]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 |..M. |
+Server MAC key[20]:
+| ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da 5a eb 1b 81 |.V.).z...5..Z...|
+| e3 58 ec 44 |.X.D |
+Client Write key[16]:
+| 29 3e 75 11 5e e1 37 30 9b 49 ac ea 01 8f 95 b6 |)>u.^.70.I......|
+Server Write key[16]:
+| 6a 87 90 52 1a c5 73 95 2e 6d 7b e5 8b 02 ed 89 |j..R..s..m{.....|
+Client Write IV[16]:
+| 18 be a5 f3 a0 6c 5d cc ee 0b 94 bf ee d4 18 97 |.....l].........|
+Server Write IV[16]:
+| 62 5b 3f ab 84 2d b7 3d ea 1a ec 7e f5 de ea 12 |b[?..-.=...~....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #293 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f...
+looking for RSA pre-master008032041c81e691596ba5ab0fbf45b29c5f64c0e2d8dcd8...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..|
+| 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.|
+| 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..|
+| ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. |
+hash out[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+PRF out[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+key expansion[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+Client MAC key[20]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 |fn. |
+Server MAC key[20]:
+| 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 52 93 70 4a |..#...~:6..$R.pJ|
+| 12 e4 9c 7f |.... |
+Client Write key[16]:
+| 08 1c d3 36 74 e5 12 9c d8 83 fb c2 0d 56 25 d3 |...6t........V%.|
+Server Write key[16]:
+| 58 ac 0e e3 57 2d fa 10 b7 fb 9b 3e 5d d1 c8 1d |X...W-.....>]...|
+Client Write IV[16]:
+| b3 67 57 e3 04 c7 25 ed 97 21 bd 41 7a 2e 87 6e |.gW...%..!.Az..n|
+Server Write IV[16]:
+| 4b c9 01 2e 82 70 53 01 71 41 ef 52 83 75 18 62 |K....pS.qA.R.u.b|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 76 ee 05 b3 ce 43 54 ae b7 42 80 62 99 39 5e 96 |v....CT..B.b.9^.|
+| fe d1 a1 fe 08 a5 93 da a2 46 2b 02 e6 7a f3 d0 |.........F+..z..|
+| 20 af 2c 26 3b 07 89 48 c0 6a 0e a2 16 ec b9 c6 | .,&;..H.j......|
+| 90 d0 c7 7a aa ca d2 f0 02 23 2d b9 e5 48 4f 0f |...z.....#-..HO.|
+Plaintext[64]:
+| d4 53 7a 8c d2 0b 73 47 f2 f9 27 88 99 10 ee 46 |.Sz...sG..'....F|
+| 14 00 00 0c b0 2d f1 76 d2 be 56 e4 9d e9 0a 53 |.....-.v..V....S|
+| b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....|
+| 60 79 d0 59 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |`y.Y............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....|
+| 60 79 d0 59 |`y.Y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #294 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 28 a6 e6 11 e9 7a 6a 68 9c 1b 91 91 4b d9 f7 b4 |(....zjh....K...|
+| 74 cb a2 a1 67 0c 63 a5 ac 46 e4 db 84 fd 8e 66 |t...g.c..F.....f|
+| 27 15 b4 2f 3c 19 3e d0 1a 3d a7 47 6a 4c eb e0 |'../<.>..=.GjL..|
+| 67 77 56 3d df 69 e7 b4 c5 87 83 34 30 fc 91 38 |gwV=.i.....40..8|
+Plaintext[64]:
+| 52 04 27 46 3c 6c 26 04 af eb 2d 3f ff 19 31 c3 |R.'F<l&...-?..1.|
+| 14 00 00 0c 26 5c cb b9 4b a0 62 cb 2e b0 f2 18 |....&\..K.b.....|
+| e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61|
+| b9 71 27 60 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.q'`............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61|
+| b9 71 27 60 |.q'` |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #295 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 12 20 e2 74 2a 11 c4 10 ed a0 aa a7 23 ca 38 c3 |. .t*.......#.8.|
+| f4 3d 4b 06 32 ed ff 62 b8 42 e4 ed c8 86 39 74 |.=K.2..b.B....9t|
+| 3b 71 af c4 0e 97 b6 7c 2a ef ef 92 d0 01 fc bd |;q.....|*.......|
+| 78 65 81 6e e2 cb 1b 6d 28 a4 60 2a 75 ba 35 e6 |xe.n...m(.`*u.5.|
+| 97 f8 04 9c fa d3 3c 07 30 7e 27 66 4f 19 33 3b |......<.0~'fO.3;|
+| 7a c1 33 d7 ef 7a a5 59 53 15 05 7c bf dc d7 08 |z.3..z.YS..|....|
+| e4 17 a2 d5 08 2c 89 eb 40 8a 07 19 90 28 52 29 |.....,..@....(R)|
+| 69 af 4f 26 e7 99 f5 2f 54 59 ca 03 f6 a7 c1 a6 |i.O&.../TY......|
+Plaintext[128]:
+| a7 c0 77 b3 8c 76 cc 8c 41 50 49 ef 86 d3 0c 3f |..w..v..API....?|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a c6 c4 f2 |n.nl:4458.......|
+| 60 32 67 48 e0 11 bc 98 89 66 b5 48 48 38 2d ae |`2gH.....f.HH8-.|
+| a8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 15 32 91 17 d5 ed 1a c3 1c ab 40 d5 3e c9 2b 25 |.2........@.>.+%|
+| bb 4b 6f be |.Ko. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44746 found (nil)
+association_find: TCP port 4458 found 0x34258f0
+
+dissect_ssl enter frame #296 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fd a4 cd 1c ed 1b 11 1a d1 45 ee 85 7a 0f 23 3b |.........E..z.#;|
+| 3e 3f 2a 0e 17 28 88 92 f2 19 9b f9 e8 f7 ff 34 |>?*..(.........4|
+| 8b 11 11 9f 63 f7 ff 22 5d a0 3f b1 9a 94 c0 d4 |....c.."].?.....|
+| 21 17 f6 ff d8 a0 1c cf 03 b0 27 35 51 34 25 0e |!.........'5Q4%.|
+| 6e cb fa 41 3e 34 c5 f4 27 b6 59 bc 5d ae 8e c1 |n..A>4..'.Y.]...|
+| 12 48 ef 40 91 5a f1 42 e3 02 6a 54 29 f9 05 19 |.H.@.Z.B..jT)...|
+| e0 21 01 17 69 a8 84 35 08 ea 09 e2 dd 1c 54 00 |.!..i..5......T.|
+| 3c 2d 7d 9a f0 10 4d c3 c6 cf 5e 09 ff d0 01 51 |<-}...M...^....Q|
+| 78 f0 63 42 9a 58 1d b4 30 4a 40 50 df 39 06 56 |x.cB.X..0J@P.9.V|
+| 3e b4 ec 9d 64 09 f0 8e d6 be 4f e3 48 33 68 b5 |>...d.....O.H3h.|
+| 94 d5 f6 db 96 e7 8e 18 2b fc 5d 5f c6 2e d7 2d |........+.]_...-|
+| 99 73 c3 f4 dd 37 54 b1 f2 5f d8 c9 de 5f bb 69 |.s...7T.._..._.i|
+| 39 68 34 8f 49 24 ca 77 e0 f0 13 20 eb c7 01 92 |9h4.I$.w... ....|
+| b6 b8 6f de 78 28 37 5a 09 69 41 2a db 3d 62 a4 |..o.x(7Z.iA*.=b.|
+| 23 1f af 54 b3 ce 6e 4e 71 35 d2 e0 db 1d 02 1f |#..T..nNq5......|
+| f8 33 d1 97 cb d7 a5 c6 f9 46 b6 98 ff 9b 26 15 |.3.......F....&.|
+| de 38 ea 5d c1 1c e2 8e 62 7d 16 c1 51 c9 ba 53 |.8.]....b}..Q..S|
+| fe 48 8e df b0 90 c5 f5 57 cd 82 31 60 3f d9 c8 |.H......W..1`?..|
+| 22 a7 34 fd 28 2c c6 59 81 df bd 53 a8 85 54 6c |".4.(,.Y...S..Tl|
+| 57 b4 6d ea d8 16 fa 9b 1b 6e 46 8d 66 6c c7 bd |W.m......nF.fl..|
+| 95 d7 0e 3c 44 84 d4 d9 cd f4 93 01 04 54 9a d8 |...<D........T..|
+| be b7 b1 d2 c3 3d 58 44 6d aa 8f 02 32 27 e7 6c |.....=XDm...2'.l|
+| 1b e3 04 0a 99 dd 11 82 03 d7 df 8f 70 f1 b7 a3 |............p...|
+| ae 81 ce de f5 4f 5a f9 fa 7f 51 cc 92 69 5d cc |.....OZ...Q..i].|
+| 2f 97 5e 55 b2 cf 22 0f 1b f3 70 92 82 d6 5d 3b |/.^U.."...p...];|
+Plaintext[400]:
+| 16 66 ed 93 a4 97 21 1f 54 59 42 ce 75 fd ce 8e |.f....!.TYB.u...|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 58 05 86 66 e9 10 03 7d 14 04 31 53 69 a1 b6 13 |X..f...}..1Si...|
+| 82 52 ac c3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 8e f2 0c 2c 53 73 b8 87 7c 12 33 34 a4 d9 fe |....,Ss..|.34...|
+| be 8b 6d f5 |..m. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4458 found 0x34258f0
+
+dissect_ssl enter frame #297 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 7d e0 a4 b5 95 8c d7 b4 f5 da c6 ce fa 28 84 19 |}............(..|
+| db 25 fa 66 97 d7 3e fa 01 9f 25 8c cd ac 46 d2 |.%.f..>...%...F.|
+| b4 8a 04 b8 4b 0a 1d 9c 47 56 42 1f 6e 4b 03 5a |....K...GVB.nK.Z|
+Plaintext[48]:
+| e2 80 85 77 af ee bc a5 4c 1a 9d 71 01 fe c3 58 |...w....L..q...X|
+| 01 00 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 |...V......X3).!0|
+| 49 74 f0 be 0c ce 09 09 09 09 09 09 09 09 09 09 |It..............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 49 74 |.V......X3).!0It|
+| f0 be 0c ce |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #299 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9d 88 b2 b6 f1 fc 08 ad 12 97 a1 40 80 72 24 7a |...........@.r$z|
+| a4 a8 28 0f c5 e2 ea ae ba 03 5f 95 27 76 48 e1 |..(......._.'vH.|
+| ed 5d 38 23 df a1 83 bb da 3d 2a 07 21 0e 36 18 |.]8#.....=*.!.6.|
+Plaintext[48]:
+| 7a 2c 25 f8 59 43 18 2f ea e6 a5 68 1a 1d 12 cc |z,%.YC./...h....|
+| 01 00 ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 |...i..../}$.}...|
+| a1 84 50 3f a2 ed 09 09 09 09 09 09 09 09 09 09 |..P?............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 a1 84 |.i..../}$.}.....|
+| 50 3f a2 ed |P?.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #304 (first time)
+ssl_session_init: initializing ptr 0x7facc383dff0 size 688
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45627 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4459
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #306 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X|
+| 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.|
+| 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..|
+| 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. |
+hash out[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+PRF out[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+key expansion[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+Client MAC key[20]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f |.J|. |
+Server MAC key[20]:
+| 93 9b ba 45 ab 1e a7 34 64 aa 88 3e 3b c5 33 e5 |...E...4d..>;.3.|
+| da 1e 6d da |..m. |
+Client Write key[16]:
+| 58 a3 23 dc 5e ce be 49 78 ff 86 f6 40 24 f8 6b |X.#.^..Ix...@$.k|
+Server Write key[16]:
+| 2b c9 6b a8 3f b3 63 ae 7f a9 61 33 d5 2a 35 5a |+.k.?.c...a3.*5Z|
+Client Write IV[16]:
+| 59 eb 97 39 0a 95 4d 35 52 6a e2 b7 e4 43 11 97 |Y..9..M5Rj...C..|
+Server Write IV[16]:
+| b3 3f 16 f1 cf 48 de cb 3d 96 4c 6b 90 e7 14 ed |.?...H..=.Lk....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #308 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cf...
+looking for RSA pre-master00804d7ad45959353a60dbb7bc3b8677ddfe7950df38c6cb...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X|
+| 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.|
+| 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..|
+| 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. |
+hash out[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+PRF out[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+key expansion[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+Client MAC key[20]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 |..$Q |
+Server MAC key[20]:
+| 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 54 df 97 7c |...Il....%o.T..||
+| 72 3c e3 dd |r<.. |
+Client Write key[16]:
+| 47 95 1d cb 70 fd a0 9d 2f a5 29 f8 a9 cb 2f 13 |G...p.../.).../.|
+Server Write key[16]:
+| 35 4d 4c a5 32 67 92 76 1b fc dd 73 b1 cc ad d6 |5ML.2g.v...s....|
+Client Write IV[16]:
+| ac b6 89 a7 36 1a 35 fb 76 13 5c 55 8e 01 a8 93 |....6.5.v.\U....|
+Server Write IV[16]:
+| 23 dd 9c 11 49 ad 1d 14 19 7b 40 5a 67 ae 1d 43 |#...I....{@Zg..C|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 89 31 47 3e d2 51 cd 32 0e c5 14 19 f7 3d 2d 99 |.1G>.Q.2.....=-.|
+| 8c 35 a5 3d df eb 96 83 17 2c d2 22 7a b0 ab 8d |.5.=.....,."z...|
+| dc 7c 40 af c7 93 e7 e8 32 94 8f 81 86 41 6a d4 |.|@.....2....Aj.|
+| 4e 77 72 44 28 3a d7 73 1c e3 2d 96 49 e4 4b 67 |NwrD(:.s..-.I.Kg|
+Plaintext[64]:
+| cc 32 e8 ed f2 bd aa a3 1c e7 4e 18 12 54 3b cb |.2........N..T;.|
+| 14 00 00 0c 56 fa fb b6 f1 01 61 53 6b e7 f2 16 |....V.....aSk...|
+| 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.|
+| 61 21 f0 d5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |a!..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.|
+| 61 21 f0 d5 |a!.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #309 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 6f 7d 75 d5 68 e8 50 bf 56 74 e2 31 32 50 be cd |o}u.h.P.Vt.12P..|
+| 7e 76 21 ef f4 4a f9 5e f1 4b 32 fe 4d 66 8b a7 |~v!..J.^.K2.Mf..|
+| 26 d4 1b 36 26 ab 52 90 0f d0 b3 62 1f e0 65 1b |&..6&.R....b..e.|
+| f8 4f 61 3b 8d 91 3f 2d 02 03 ba 60 a5 f4 8c ee |.Oa;..?-...`....|
+Plaintext[64]:
+| 31 53 dd d4 5b 02 e9 48 30 8d f1 3d 8b f1 04 25 |1S..[..H0..=...%|
+| 14 00 00 0c 7a 76 e1 e0 89 d8 c7 5b 54 3c c2 99 |....zv.....[T<..|
+| ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(|
+| 27 9e 48 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |'.H.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(|
+| 27 9e 48 0b |'.H. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #310 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| d2 7a a9 6b d2 35 c6 d3 63 d3 68 6b 62 1c c1 96 |.z.k.5..c.hkb...|
+| bb 3d 71 8c dd 9f d6 05 e4 7d ad 8a 7d be de 5b |.=q......}..}..[|
+| 8f 8c 2f 09 a5 03 c1 01 9a d5 f1 41 93 71 1a 1c |../........A.q..|
+| 1d 67 7e c4 01 1b 6b 0d 77 d8 c3 66 85 b4 3c 42 |.g~...k.w..f..<B|
+| d9 e4 d0 f9 a2 3e 16 35 26 bd 7b 0d ee 30 25 eb |.....>.5&.{..0%.|
+| be 0f 33 92 01 16 47 88 af be 92 f4 ee 66 8c 37 |..3...G......f.7|
+| 1a a4 2e 6f 6d 01 a6 ad 7c 55 a7 d0 47 a8 fe f6 |...om...|U..G...|
+| 05 9e 7c ed a1 ea 1e a3 ee 6e 46 92 26 b0 02 8a |..|......nF.&...|
+Plaintext[128]:
+| a0 ef 57 7a 37 3a 92 ca 76 dd d5 36 59 33 69 6e |..Wz7:..v..6Y3in|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a 3d 98 be |n.nl:4459....=..|
+| ad c3 82 26 b5 c4 04 26 ab 26 e3 c4 0b 51 75 e6 |...&...&.&...Qu.|
+| 2d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |-...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 03 48 86 ee fb d5 a2 b3 65 e6 04 af 0b 04 61 72 |.H......e.....ar|
+| b0 ed 40 70 |..@p |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45627 found (nil)
+association_find: TCP port 4459 found 0x3328090
+
+dissect_ssl enter frame #311 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d3 f6 28 f3 d3 92 1b 76 e1 8d 33 fa 6a f0 5f 26 |..(....v..3.j._&|
+| 15 48 68 96 f8 26 f3 50 ed 3a be 5d ee c4 72 d2 |.Hh..&.P.:.]..r.|
+| 22 46 c9 20 d4 ea 27 8e a2 be 42 98 92 a7 ab db |"F. ..'...B.....|
+| 25 cb 67 3c b9 5e 10 f5 1b 99 7b 2c 62 d1 ff d6 |%.g<.^....{,b...|
+| 15 d2 35 37 7f 6c 38 a9 15 a2 e8 9f 43 53 dd 85 |..57.l8.....CS..|
+| 1e a8 11 03 4a 4d da 0a cc 4c 39 f6 e2 dd b7 27 |....JM...L9....'|
+| 71 7d 52 18 d5 5e 11 c0 81 be 94 53 38 59 a4 12 |q}R..^.....S8Y..|
+| f2 0a f6 60 19 db 0c dd fa 81 ba f9 3f c0 53 ee |...`........?.S.|
+| 67 f3 04 88 04 47 6e 60 98 cb f2 85 a7 1e f4 ef |g....Gn`........|
+| a7 af bb a1 a6 6e 77 d9 ff e7 16 ce 12 99 77 eb |.....nw.......w.|
+| 3c ff 72 63 95 51 49 51 27 74 58 78 11 59 c8 8a |<.rc.QIQ'tXx.Y..|
+| cf f7 c9 dc 54 24 43 0e 67 a4 cd bf 04 65 f2 5a |....T$C.g....e.Z|
+| e0 58 29 27 c9 f2 51 51 b6 0e e7 b2 20 ad 31 f7 |.X)'..QQ.... .1.|
+| d6 7f 1d 01 02 f0 6c 28 e1 0a 4c 06 75 96 13 68 |......l(..L.u..h|
+| e2 36 33 79 8f c8 9b 9d 69 ba 41 a6 70 44 2c 1b |.63y....i.A.pD,.|
+| 90 e5 ea 22 ee 70 96 cf e2 50 b6 b1 f7 56 66 8b |...".p...P...Vf.|
+| 06 ba fc 8c e3 68 d0 29 6c 50 3c 74 da 97 26 f1 |.....h.)lP<t..&.|
+| b7 da e8 79 80 52 45 1e 2a 5d 11 79 c1 6b 0e 65 |...y.RE.*].y.k.e|
+| 62 a8 eb 00 39 c7 b2 6e 6f f8 ab 9e a7 fe 15 53 |b...9..no......S|
+| 6a bf 96 0a 9a cf 20 13 60 9e a5 88 d1 5c c1 2e |j..... .`....\..|
+| 7e 7f 6c d1 cf e7 a4 f7 7b 0f 07 87 db 64 77 83 |~.l.....{....dw.|
+| 34 09 99 14 a7 0e a2 ab 08 e3 87 ee 12 7b 70 a5 |4............{p.|
+| 2d bd 55 3f d6 91 66 fa 7d 76 c9 62 b1 b1 b8 94 |-.U?..f.}v.b....|
+| ac 09 51 4e 28 fb e2 dc af 18 c1 30 ce bf 99 21 |..QN(......0...!|
+| 44 9a 9f 41 4a 4e da dd b8 1e 3c 55 b0 e3 8f e9 |D..AJN....<U....|
+Plaintext[400]:
+| d6 64 5d 94 4d 17 cc d5 18 1f 6c 6a 59 ff 69 e4 |.d].M.....ljY.i.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| e7 07 5d 56 06 9f 5f 9e 62 c4 ac 44 5a 46 88 08 |..]V.._.b..DZF..|
+| c0 5d a9 25 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.].%............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9a 34 f7 7e ac a3 fa 2d d9 6e 32 9d d8 53 af f5 |.4.~...-.n2..S..|
+| 41 dc e8 24 |A..$ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4459 found 0x3328090
+
+dissect_ssl enter frame #312 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3e 26 3f 1a 0f b8 ba 30 38 51 ba 0e 2b d6 7e f9 |>&?....08Q..+.~.|
+| 17 63 34 f2 5f 32 d7 d5 15 42 95 9a b6 2f 32 93 |.c4._2...B.../2.|
+| d3 b8 c2 8b ff fd 10 c6 81 d3 72 db d6 d6 ad 44 |..........r....D|
+Plaintext[48]:
+| 56 2c b3 ff 6c 96 0e c4 f5 ad a3 87 c5 99 04 71 |V,..l..........q|
+| 01 00 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 |..J;...f.?(.,...|
+| ca a8 13 ec 1f 4a 09 09 09 09 09 09 09 09 09 09 |.....J..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 ca a8 |J;...f.?(.,.....|
+| 13 ec 1f 4a |...J |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #314 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| fb 15 dc 4b ab c1 4d f4 ce 06 a6 27 76 3f 01 4a |...K..M....'v?.J|
+| 2e 5e 4e 52 c0 9e a8 56 e2 9c 03 e8 54 2c 65 34 |.^NR...V....T,e4|
+| 30 92 c7 5d 78 d8 50 ab ab 09 47 fa 22 51 55 b9 |0..]x.P...G."QU.|
+Plaintext[48]:
+| 7d 23 d5 16 80 35 92 c6 14 53 8c 1c bb c3 7a 2f |}#...5...S....z/|
+| 01 00 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 |...:.6..FN..,...|
+| 6d 6b 10 bb 5d 2a 09 09 09 09 09 09 09 09 09 09 |mk..]*..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 6d 6b |.:.6..FN..,...mk|
+| 10 bb 5d 2a |..]* |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #319 (first time)
+ssl_session_init: initializing ptr 0x7facc3840530 size 688
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45960 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4463
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #321 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G|
+| 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.|
+| 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....|
+| 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= |
+hash out[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+PRF out[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+key expansion[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+Client MAC key[20]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 |.... |
+Server MAC key[20]:
+| 76 10 cc d5 50 2a 86 bd 16 07 49 53 f7 d3 3e 3c |v...P*....IS..><|
+| 17 28 b4 b8 |.(.. |
+Client Write key[32]:
+| a2 ab 9c b8 88 7c b6 2e 70 e2 d1 ca c8 11 9b e0 |.....|..p.......|
+| 4a 52 46 48 3b e9 8d f6 11 09 8d 54 62 29 25 48 |JRFH;......Tb)%H|
+Server Write key[32]:
+| bd 6c 26 ac 29 7e d2 e5 0a e0 d9 a1 75 fd cd 1a |.l&.)~......u...|
+| 6a f1 6d d3 f8 83 be 47 d0 99 fe 8b 13 46 0a e6 |j.m....G.....F..|
+Client Write IV[16]:
+| b6 15 ee a8 55 22 16 51 cb cc f2 cc 09 cf 21 3c |....U".Q......!<|
+Server Write IV[16]:
+| c3 b5 2e 5b e3 bb a8 86 70 55 ea f6 83 1f f8 6f |...[....pU.....o|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #323 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6...
+looking for RSA pre-master28a5e5ae37eb7d5c1b3740154edc21c244ade2aa80b2c5a9...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G|
+| 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.|
+| 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....|
+| 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= |
+hash out[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+PRF out[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+key expansion[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+Client MAC key[20]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 |..|. |
+Server MAC key[20]:
+| 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 9d a1 9f 69 |.,i............i|
+| e6 49 d6 dd |.I.. |
+Client Write key[32]:
+| ef fc d6 9e 44 fc 5f 81 35 02 8b 36 64 82 23 43 |....D._.5..6d.#C|
+| 30 74 6a cd 9f ea 1e 8a 49 74 50 3d 3b 5c f2 4b |0tj.....ItP=;\.K|
+Server Write key[32]:
+| 73 02 65 23 da 1f 5a d8 ed 23 88 ca f4 e1 83 d7 |s.e#..Z..#......|
+| e4 07 4c ba cf 48 9b ef cd b1 86 a0 57 8a 98 41 |..L..H......W..A|
+Client Write IV[16]:
+| 9f ed 72 49 5d 55 79 e5 50 72 78 77 39 7c be cf |..rI]Uy.Prxw9|..|
+Server Write IV[16]:
+| 01 f6 41 cf 24 03 3d 64 be 57 98 9c ce ad e6 5a |..A.$.=d.W.....Z|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 47 fb 9b b3 2e b2 65 44 ee 57 a7 f1 85 8e 12 a1 |G.....eD.W......|
+| 43 56 d0 2e c9 23 46 5d a9 c9 7f 35 75 35 a4 fa |CV...#F]...5u5..|
+| 1d 43 9f b0 05 db f4 90 e4 df 2f 14 44 90 35 18 |.C......../.D.5.|
+| 4d 12 bb 03 57 22 96 b0 08 46 02 de df 62 98 d7 |M...W"...F...b..|
+Plaintext[64]:
+| 24 b4 d0 d7 36 77 13 dc 8e d1 bc 52 c6 d7 7f f8 |$...6w.....R....|
+| 14 00 00 0c a4 a1 8e 8a a4 ee 69 b8 73 ed e5 91 |..........i.s...|
+| fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......|
+| 88 11 12 6c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...l............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......|
+| 88 11 12 6c |...l |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #324 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 02 72 8d d9 a7 0e 3f 32 a1 e9 0b 9f 93 f6 7e 34 |.r....?2......~4|
+| 39 23 ae 0d eb d7 b8 44 bb 2f 93 f1 83 35 24 22 |9#.....D./...5$"|
+| 78 28 7f 03 8a 3c 74 83 27 0d b0 fb 46 56 6d 91 |x(...<t.'...FVm.|
+| ae 8e 54 fd 98 a1 74 ee 33 9d 2d aa 65 29 5c 4c |..T...t.3.-.e)\L|
+Plaintext[64]:
+| f6 d4 9b d1 5c 7b 6d c4 f5 f2 79 77 23 cf 7f cb |....\{m...yw#...|
+| 14 00 00 0c 60 5d 71 3c 03 df f1 a7 bc 91 99 b7 |....`]q<........|
+| 7a 79 41 a0 dd dd af 7e 3b 97 5f 72 73 91 8d a7 |zyA....~;._rs...|
+| 5b 20 05 39 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |[ .9............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7a 79 41 a0 dd dd af 7e 3b 97 5f 72 73 91 8d a7 |zyA....~;._rs...|
+| 5b 20 05 39 |[ .9 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #325 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 85 78 9f 2c 72 2b 33 2b 32 cd 87 d8 24 ea 0c 37 |.x.,r+3+2...$..7|
+| 33 4e 2b 57 19 b4 54 55 6e b2 98 88 c0 d7 58 9a |3N+W..TUn.....X.|
+| 89 25 44 55 9c 04 71 00 9a 0b 52 d9 6d 3e 77 e8 |.%DU..q...R.m>w.|
+| a5 91 88 b0 1e 61 8e 98 3f 31 23 63 47 91 59 31 |.....a..?1#cG.Y1|
+| d1 d1 bb ab f8 d5 d5 a2 5f 1c 96 79 20 6c e3 65 |........_..y l.e|
+| db 3d 7f b2 be d9 e5 31 86 23 02 f6 01 a8 c6 92 |.=.....1.#......|
+| 20 5a 32 85 59 28 18 ea f7 d6 aa 87 1b c8 1c 5a | Z2.Y(.........Z|
+Plaintext[112]:
+| 85 d9 c4 10 d3 53 d3 34 da 45 35 ae 4d 4a 96 13 |.....S.4.E5.MJ..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25|
+| 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446|
+| 33 0d 0a 0d 0a 9b ae 04 4b b5 f7 b2 5c 7b 34 a9 |3.......K...\{4.|
+| cc 22 b4 7d b9 ed 9b 6c 13 06 06 06 06 06 06 06 |.".}...l........|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 37 5d 52 b5 a7 ae 5e 90 41 3b ba 07 6b ac 99 c3 |7]R...^.A;..k...|
+| df 2c f1 b2 |.,.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45960 found (nil)
+association_find: TCP port 4463 found 0x33292f0
+
+dissect_ssl enter frame #326 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 80 3f 74 e5 3b a0 39 64 10 ea 3c 88 07 0c 79 d5 |.?t.;.9d..<...y.|
+| f1 00 2e 2a 5b 6e 6d 18 d4 b5 e9 85 5c 95 b9 3d |...*[nm.....\..=|
+| 26 23 ec f0 0b 4b 40 ce 5a 31 a9 7c d9 a7 11 6d |&#...K@.Z1.|...m|
+| 14 f7 bd 3a ec ac e7 cd c4 fb 3b 9d 14 2e c4 98 |...:......;.....|
+| 70 4f 4f 87 f4 57 59 79 ec 33 b4 22 6b 36 cf 24 |pOO..WYy.3."k6.$|
+| ad 1e 13 bf 52 38 c3 55 9e ed 34 43 04 c3 d3 4e |....R8.U..4C...N|
+| c1 c9 72 a7 8d 90 31 f2 e1 23 dd 09 16 63 50 b5 |..r...1..#...cP.|
+| fe 73 d3 a8 aa 45 70 7c 1a 5c 09 2d a4 57 47 88 |.s...Ep|.\.-.WG.|
+| a2 97 08 cc 44 5e 7f 8c 41 cb ef 02 33 83 c5 f0 |....D^..A...3...|
+| 10 d3 fb 21 ae 09 15 b7 e4 04 44 b9 40 69 4b 97 |...!......D.@iK.|
+| 34 56 38 5a 9d 9a 0e 0d 72 59 82 21 54 4a 5b 00 |4V8Z....rY.!TJ[.|
+| e9 23 1c 44 c5 8b ed 7b ca 43 af b0 3d 0a 4a 76 |.#.D...{.C..=.Jv|
+| 5c 75 cd 04 c9 8a cc 16 08 da c7 20 44 9b 36 3b |\u......... D.6;|
+| 86 d4 2c 45 07 97 82 b5 f2 bd 8d ec 60 20 5c 88 |..,E........` \.|
+| 79 e7 b5 b0 90 6c fd 6d 59 12 18 ec 06 fa 9e b8 |y....l.mY.......|
+| ac fe 3e 07 45 42 bc f0 71 d8 c7 04 bc 7f 11 fc |..>.EB..q.......|
+| c1 d6 6b fa 1b 80 18 32 87 e4 9a 24 5f 1d 5f 51 |..k....2...$_._Q|
+| 42 8d f7 44 9e 06 1e 2d 3e 64 a4 be 17 05 38 7a |B..D...->d....8z|
+| 35 6c f2 3e 6a a6 82 f8 68 66 e9 95 8d 7d e7 09 |5l.>j...hf...}..|
+| a3 2a 33 3a 57 fa 42 ed b9 c0 f3 d9 c4 26 9d a0 |.*3:W.B......&..|
+| 13 1f de 4e 46 01 f5 f1 7c ac 1f 02 2f 2f d8 4f |...NF...|...//.O|
+| 17 95 56 75 d1 95 0a 01 c3 48 05 2e 3d 11 54 f5 |..Vu.....H..=.T.|
+| 25 58 7b e1 d8 35 a9 93 98 5c 91 a6 da 58 f2 91 |%X{..5...\...X..|
+| 9e f1 d0 e0 bd 76 06 ea e4 e7 66 ab 01 99 af fd |.....v....f.....|
+| ce f5 95 4e ef 40 7a f4 4c bd 39 59 29 a1 1d 7e |...N.@z.L.9Y)..~|
+Plaintext[400]:
+| 39 da 10 18 16 5d da d5 1a 93 51 26 b7 10 25 fa |9....]....Q&..%.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL|
+| 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 4d 20 9d 67 77 69 ef d0 35 d1 eb 1d a1 23 d3 44 |M .gwi..5....#.D|
+| e4 79 3b 4d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.y;M............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6a 8e e9 2a e9 ce 28 ac 0b d3 c7 6a 1d fd ed 93 |j..*..(....j....|
+| b0 10 65 0f |..e. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4463 found 0x33292f0
+
+dissect_ssl enter frame #327 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2f fa 91 20 7b ba 19 80 01 32 8c 17 e0 75 25 41 |/.. {....2...u%A|
+| 41 0c f5 3c 46 bd c2 f3 56 19 92 48 92 f5 57 66 |A..<F...V..H..Wf|
+| aa 2b e6 a2 d9 dd 5e 02 84 89 97 38 b8 ad 28 63 |.+....^....8..(c|
+Plaintext[48]:
+| b3 b5 9f 91 ae 7f 16 e6 2a 6f fc 4e 60 6e 56 e7 |........*o.N`nV.|
+| 01 00 ad 9b 1a 4d cf f3 92 91 78 cd ea bc e2 02 |.....M....x.....|
+| 33 98 af f5 1a 8e 09 09 09 09 09 09 09 09 09 09 |3...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ad 9b 1a 4d cf f3 92 91 78 cd ea bc e2 02 33 98 |...M....x.....3.|
+| af f5 1a 8e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #329 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9a ce 46 29 27 09 b2 14 40 0a a7 b5 c3 e4 a6 00 |..F)'...@.......|
+| 9b ef c7 cd c5 1d f9 8b b7 05 7a 29 43 5d 73 56 |..........z)C]sV|
+| 64 a7 1e 82 13 b7 fd 26 4f c1 dc b5 f0 67 10 ef |d......&O....g..|
+Plaintext[48]:
+| 8b 81 b6 5f f3 26 c3 43 a6 52 d5 e0 91 b9 90 ee |..._.&.C.R......|
+| 01 00 56 96 1b 1c e7 8b 26 a0 89 26 5e ad 69 9d |..V.....&..&^.i.|
+| a7 69 5f 27 ff 83 09 09 09 09 09 09 09 09 09 09 |.i_'............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 56 96 1b 1c e7 8b 26 a0 89 26 5e ad 69 9d a7 69 |V.....&..&^.i..i|
+| 5f 27 ff 83 |_'.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #334 (first time)
+ssl_session_init: initializing ptr 0x7facc3842ab0 size 688
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46494 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4464
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #336 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.|
+| ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U...<b..f&.R4.|
+| 24 28 c1 c4 75 59 4c c2 30 9b ab 49 b8 5e 34 2a |$(..uYL.0..I.^4*|
+| af e5 38 3d 51 a9 74 b4 30 4f d1 45 8b |..8=Q.t.0O.E. |
+hash out[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+PRF out[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+key expansion[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+Client MAC key[20]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed |..B. |
+Server MAC key[20]:
+| f0 32 c0 26 48 8f fb b2 07 51 6d b7 a0 b4 0e ab |.2.&H....Qm.....|
+| bc 15 02 57 |...W |
+Client Write key[32]:
+| 89 8a 79 a6 e2 95 79 3a 0b 06 53 8a 59 5b 25 b3 |..y...y:..S.Y[%.|
+| f2 f6 78 5b d7 2e 1c d6 cc 85 0c a1 2b e5 ea cf |..x[........+...|
+Server Write key[32]:
+| c2 39 41 e4 25 e4 37 33 2c ba fd 95 bc 23 3d 7e |.9A.%.73,....#=~|
+| 80 e2 b9 ad c1 8e 97 45 d8 bc ec e9 54 af e6 03 |.......E....T...|
+Client Write IV[16]:
+| e2 fd 33 7a 84 9e 49 8e 81 a2 63 52 d2 f4 c5 96 |..3z..I...cR....|
+Server Write IV[16]:
+| 76 f9 e2 9e cf b5 fa 1b c9 c2 21 7a c6 0d 29 8e |v.........!z..).|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #338 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51...
+looking for RSA pre-master0080868cbc83906b6ee24c5d9e1ee3ad9985776eaff74dc0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.|
+| ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U...<b..f&.R4.|
+| 24 28 c1 c4 75 59 4c c2 30 9b ab 49 b8 5e 34 2a |$(..uYL.0..I.^4*|
+| af e5 38 3d 51 a9 74 b4 30 4f d1 45 8b |..8=Q.t.0O.E. |
+hash out[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+PRF out[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+key expansion[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+Client MAC key[20]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 |.Q`( |
+Server MAC key[20]:
+| 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa 33 d2 19 11 |UN{..4......3...|
+| aa fb 49 ff |..I. |
+Client Write key[32]:
+| db 90 40 21 34 51 40 e8 6f 43 d9 f2 a0 70 f5 1c |..@!4Q@.oC...p..|
+| 29 d5 18 c4 8f 5c 3a b5 8f 00 82 bc 09 23 38 1c |)....\:......#8.|
+Server Write key[32]:
+| 1e 6d e3 3b ca 9f 06 47 a7 d2 76 55 af 1f 77 eb |.m.;...G..vU..w.|
+| 20 95 5a d8 6e 45 d2 93 7a 51 47 8d e2 18 7e bf | .Z.nE..zQG...~.|
+Client Write IV[16]:
+| 3f b2 d6 da 35 b8 26 89 e6 32 0e 33 5d 7a 1d 7c |?...5.&..2.3]z.||
+Server Write IV[16]:
+| b5 1e 0b 33 cb 8a 17 3d 06 49 69 81 80 13 33 d9 |...3...=.Ii...3.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 91 8f ea bd 78 9b 2c b1 e8 ab 4d f4 f3 78 d4 45 |....x.,...M..x.E|
+| e9 9b 56 b0 c6 50 9d 3f f0 73 0c f4 31 99 22 3b |..V..P.?.s..1.";|
+| ad ae 64 7d e5 9e 64 a9 5b f9 f0 5f a3 64 f7 d3 |..d}..d.[.._.d..|
+| 6e ea 93 ca 69 9d 4e 7d cd 63 51 3e 8a 9b c7 b8 |n...i.N}.cQ>....|
+Plaintext[64]:
+| 26 fc 91 f6 e2 86 7d 37 70 47 3b 54 2b 52 3e c7 |&.....}7pG;T+R>.|
+| 14 00 00 0c fa db c0 11 3f c8 41 79 2c 6e 9b 0c |........?.Ay,n..|
+| 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s|
+| 56 1f 24 47 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |V.$G............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s|
+| 56 1f 24 47 |V.$G |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #339 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f5 02 c7 af 76 da 1d 26 df d0 99 08 80 87 c1 c0 |....v..&........|
+| 06 9f aa ea 77 b7 36 6e c8 4c 24 18 f3 32 26 cf |....w.6n.L$..2&.|
+| b1 7e 07 64 ac 97 32 34 48 84 58 77 5e ce bc 44 |.~.d..24H.Xw^..D|
+| a2 5f 0f c5 c4 a2 cd a9 1d a2 f4 f4 70 47 25 0b |._..........pG%.|
+Plaintext[64]:
+| 77 a0 f2 7d 13 86 ff ad 89 da 5e f6 2e e2 21 89 |w..}......^...!.|
+| 14 00 00 0c e4 6f f6 f8 4f f8 97 6f 90 e1 ae d7 |.....o..O..o....|
+| 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.|
+| 6d ce 01 fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.|
+| 6d ce 01 fc |m... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #340 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 94 69 cf 52 91 aa 64 9a b7 b4 aa a3 73 88 43 d5 |.i.R..d.....s.C.|
+| a1 e0 de 8a 57 e6 fa 44 f0 84 4d c7 0b 5f 77 b7 |....W..D..M.._w.|
+| cd ab d3 12 f4 5f 83 cd dd 07 4a 19 a2 13 0f 5a |....._....J....Z|
+| 8b 89 b9 ed e4 22 5f 15 82 fb 7f 93 26 a1 cf d6 |....."_.....&...|
+| d6 0e 7d dc f9 cc 52 0f d6 bf 75 ad da 43 62 64 |..}...R...u..Cbd|
+| 35 ab 4b 92 23 9b 39 9b bd 85 67 2a 4c c3 c7 5e |5.K.#.9...g*L..^|
+| c1 12 a3 cd 28 42 a1 5a fd f4 ec 4c 65 c1 1b 6b |....(B.Z...Le..k|
+| 6d 3f cf 83 c2 59 b0 91 b2 86 42 83 3e 14 4e 1e |m?...Y....B.>.N.|
+Plaintext[128]:
+| a2 de e4 4e ac eb 71 32 47 25 4c 54 27 c0 03 c3 |...N..q2G%LT'...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a 08 02 fe |n.nl:4464.......|
+| fb 08 70 fa 53 4b fb 93 27 16 f1 77 e1 fd 0a 58 |..p.SK..'..w...X|
+| 32 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |2...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 2c b5 a9 5c 80 e8 38 4f a1 5a 1a cb 97 6e 3e |.,..\..8O.Z...n>|
+| f5 8e 67 dd |..g. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 46494 found (nil)
+association_find: TCP port 4464 found 0x3329380
+
+dissect_ssl enter frame #341 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d1 55 16 ed 01 dc a3 cc db f7 c0 01 9b 99 7b df |.U............{.|
+| 0b d8 37 20 65 cd c4 32 92 44 2b 35 56 fb fe f8 |..7 e..2.D+5V...|
+| 65 c4 b0 d6 af f9 a8 7f a4 cf 85 4b c3 52 7b cc |e..........K.R{.|
+| e1 7d 9c 34 42 77 bd b4 d6 1f 93 8e a5 0f 44 f5 |.}.4Bw........D.|
+| cf 12 e8 d6 ca 71 0a 33 6b 6f c2 17 e7 d0 4b a0 |.....q.3ko....K.|
+| da 67 86 c0 e0 e5 1e d3 4b ef ce 1a c5 a3 8d 49 |.g......K......I|
+| dc 23 48 f9 a6 71 52 9c 90 39 d4 1a 4c c2 ec 85 |.#H..qR..9..L...|
+| 3d 70 25 36 3a ad 94 b4 8b 49 71 54 15 e1 8b 35 |=p%6:....IqT...5|
+| 30 29 a3 d3 38 45 0f 26 94 f2 44 4f 4e 3c b4 97 |0)..8E.&..DON<..|
+| 11 fc c0 96 6d 1e c1 43 87 27 7d 12 72 83 82 99 |....m..C.'}.r...|
+| cd 1e a8 98 fe dd dc 8d 88 31 13 ba 03 d4 fb 34 |.........1.....4|
+| 89 a3 bb ae b9 50 88 83 33 97 60 f6 be b6 09 6c |.....P..3.`....l|
+| 1a cd 72 8c 16 13 b6 3b 25 76 f6 e6 a0 b0 a2 01 |..r....;%v......|
+| 13 02 e9 52 16 55 fd cd a6 7d a1 3b da 07 3d b4 |...R.U...}.;..=.|
+| 80 4a f1 7f f1 6c 87 01 16 2a 13 d6 17 b5 4e fd |.J...l...*....N.|
+| 0c 8d 1c 48 d0 a5 dd ca 88 4e 0b 71 a9 64 fa b2 |...H.....N.q.d..|
+| 72 c6 04 e6 a6 45 21 5f f0 e9 b3 b2 8e 2a 97 01 |r....E!_.....*..|
+| 26 d7 db d0 cb 5e e8 ad 10 67 bc ab 34 aa 22 d1 |&....^...g..4.".|
+| fc 15 a4 69 aa e5 16 60 66 64 b7 2a ba ed 22 32 |...i...`fd.*.."2|
+| ee ce 25 67 59 51 01 ca c0 fe 83 45 e0 13 30 d1 |..%gYQ.....E..0.|
+| 03 2c 70 83 6c 78 dc 05 3f 9a 24 db fa 5a 79 93 |.,p.lx..?.$..Zy.|
+| ad 24 37 79 03 b5 0a 7c 9d 70 0e 27 4f c6 df 49 |.$7y...|.p.'O..I|
+| 75 48 17 1b d4 f9 c4 ee f6 0e 25 5b 3c 3c ee 24 |uH........%[<<.$|
+| e0 db 23 6b d1 6f f3 70 fa b9 e4 6a bb b5 19 be |..#k.o.p...j....|
+| 82 2a b9 1c 42 59 6d b3 34 0f b1 3e ce fa f3 3c |.*..BYm.4..>...<|
+Plaintext[400]:
+| 56 d8 90 48 74 3a cb a2 26 96 76 52 d3 2a d7 62 |V..Ht:..&.vR.*.b|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 9d 2f 0f ef c7 0f ce 43 a6 ee 38 8b 89 9c c5 fc |./.....C..8.....|
+| e0 9c e3 d2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c ef 7b 0c b7 61 63 78 62 4a 31 d9 d5 9c f5 fe |..{..acxbJ1.....|
+| 8c 51 93 86 |.Q.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4464 found 0x3329380
+
+dissect_ssl enter frame #342 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 73 c0 6a d0 83 12 3f 6c 73 dd 27 97 76 e3 58 11 |s.j...?ls.'.v.X.|
+| f5 5d 87 8d 64 29 4d c5 83 93 55 43 2c 8b 72 fa |.]..d)M...UC,.r.|
+| c4 da 78 2c 9b a1 ee d5 8d 38 da d6 27 ce ee 88 |..x,.....8..'...|
+Plaintext[48]:
+| 39 d2 ca 89 a0 d7 8f db 1c ab 32 e6 34 ad 7f 5d |9.........2.4..]|
+| 01 00 bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 |......>.X..^....|
+| f4 fe aa 02 19 7f 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 f4 fe |....>.X..^......|
+| aa 02 19 7f |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #344 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c2 9c 16 b7 51 d3 f3 82 ab 81 37 5d 14 01 60 7a |....Q.....7]..`z|
+| d6 c0 f6 e8 3c 17 5d 4a 61 ab 32 2e 11 19 49 00 |....<.]Ja.2...I.|
+| dd 61 dc 76 38 55 06 ae 41 9e de f4 74 70 f3 4e |.a.v8U..A...tp.N|
+Plaintext[48]:
+| 4b b8 f2 c8 d7 66 d7 59 07 9f 04 af 0d 1f 56 16 |K....f.Y......V.|
+| 01 00 f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be |....Iv!...{F....|
+| db be 97 91 fc 8d 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be db be |..Iv!...{F......|
+| 97 91 fc 8d |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #349 (first time)
+ssl_session_init: initializing ptr 0x7facc3844ff0 size 688
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56836 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4465
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #351 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%|
+| b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.|
+| 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..|
+| 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... |
+hash out[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+PRF out[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+key expansion[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+Client MAC key[20]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b |../; |
+Server MAC key[20]:
+| f1 10 84 e3 4b 5b 18 1a c2 93 19 dd 25 ae e3 68 |....K[......%..h|
+| bf 0f e0 03 |.... |
+Client Write key[32]:
+| c5 69 45 6d da 9d 43 ef 3d e5 25 ac 87 ec 10 ca |.iEm..C.=.%.....|
+| d6 58 dd 57 6a 3e 8b 0c 1e 44 44 27 68 0e 21 e1 |.X.Wj>...DD'h.!.|
+Server Write key[32]:
+| 2a 47 27 f8 df 6b 86 b7 80 cd 51 e2 cb 52 2f 43 |*G'..k....Q..R/C|
+| 86 61 e4 42 d7 72 2b 05 55 89 70 37 79 dc d0 8b |.a.B.r+.U.p7y...|
+Client Write IV[16]:
+| 88 d8 45 5a 2c d1 f4 d2 db 96 a2 be af d9 c4 1c |..EZ,...........|
+Server Write IV[16]:
+| 35 9c 36 26 b3 31 72 fb 4c 16 bc 06 78 d2 25 bc |5.6&.1r.L...x.%.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #353 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9...
+looking for RSA pre-master008078d26263650f6ddf092133c693e2b2727a3db5f9f9d5...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%|
+| b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.|
+| 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..|
+| 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... |
+hash out[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+PRF out[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+key expansion[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+Client MAC key[20]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 |7.bE |
+Server MAC key[20]:
+| c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 1c 90 8c 96 |.^.......}.X....|
+| aa d3 e4 c1 |.... |
+Client Write key[32]:
+| c4 83 81 78 13 b0 fe db 15 f3 3b dc a7 da 98 12 |...x......;.....|
+| 2f 97 75 23 1c 00 f4 28 5e c2 2e 5c 1b c4 c7 60 |/.u#...(^..\...`|
+Server Write key[32]:
+| e1 9b b8 54 4b 25 6f 06 3c 22 f3 3b c3 fc 2d a1 |...TK%o.<".;..-.|
+| 88 13 85 f6 39 53 5c c1 15 b8 90 a4 7a 16 4c 18 |....9S\.....z.L.|
+Client Write IV[16]:
+| 94 f4 1b 79 a4 09 5a 61 01 11 50 8c ca 6d df a4 |...y..Za..P..m..|
+Server Write IV[16]:
+| 4a 3c 2a 9a 34 cb 52 07 6b ad bc c7 6e 26 de 14 |J<*.4.R.k...n&..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fa 68 d8 87 92 30 22 84 16 34 84 dd 38 e6 1d 34 |.h...0"..4..8..4|
+| 14 ab 5e 86 34 b8 f3 df 6c 43 05 bb 31 1c 09 a8 |..^.4...lC..1...|
+| 56 8a 1a 21 88 32 ef 18 e1 b7 53 c4 31 95 69 ea |V..!.2....S.1.i.|
+| da b8 42 cc d6 1b ec 7a eb 86 c5 3a 0f 2b 58 69 |..B....z...:.+Xi|
+Plaintext[64]:
+| 4b b8 fa 75 08 4a 3f a9 c8 db 63 5d 13 5a 69 5d |K..u.J?...c].Zi]|
+| 14 00 00 0c ae e2 6a 45 89 9e 66 35 23 cf 96 21 |......jE..f5#..!|
+| bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.|
+| 1e 26 31 4a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.&1J............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.|
+| 1e 26 31 4a |.&1J |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #354 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 40 79 2f 88 65 aa f4 a1 4f dd 22 db f8 2b 5d f0 |@y/.e...O."..+].|
+| 9c 00 d4 0c e8 14 b1 79 9f a7 35 64 96 a0 a6 74 |.......y..5d...t|
+| 14 3d f5 b1 2d 07 79 9e bd ac b1 c4 fc 31 ce b9 |.=..-.y......1..|
+| 57 91 ad 39 f0 8e c6 82 25 39 1e d4 3c 28 11 4c |W..9....%9..<(.L|
+Plaintext[64]:
+| f9 8c 08 20 64 18 84 fb cf b0 01 9f 18 29 aa 5c |... d........).\|
+| 14 00 00 0c e0 07 f0 70 10 cf 3e af 77 24 da 12 |.......p..>.w$..|
+| 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..|
+| bd 87 0e 8d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..|
+| bd 87 0e 8d |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #355 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 55 f0 1a 31 5e cb a0 5b 0f 9f e1 bd 94 ce 47 5d |U..1^..[......G]|
+| d9 d2 82 de 4a 62 4c 6b 65 dd 66 cb 40 d5 f7 38 |....JbLke.f.@..8|
+| 2f 6f 54 fa a8 c7 b6 c8 1d 0c 0f 9d 60 67 a6 53 |/oT.........`g.S|
+| c5 f3 f2 de e7 11 04 6f 18 28 b7 b5 da a9 04 e2 |.......o.(......|
+| 16 04 0a 90 7c 37 1e e7 d3 be f6 53 ad 43 c0 53 |....|7.....S.C.S|
+| 1c 1d 73 2d f6 39 6d b5 00 bc 9d 92 0b d7 7b 57 |..s-.9m.......{W|
+| ee 50 fd bc 91 c3 07 56 99 2b 2d 39 74 21 ff 16 |.P.....V.+-9t!..|
+| 4f 74 6b 4b e6 ce 12 ad 23 cf b7 22 22 3e a9 53 |OtkK....#.."">.S|
+Plaintext[128]:
+| 80 b2 67 f2 b3 04 ab 90 ba d6 20 26 56 47 bd ed |..g....... &VG..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a c5 76 a8 |n.nl:4465.....v.|
+| fc 7c d4 c7 4d 40 29 77 4d d9 68 ab 41 94 9f 1e |.|..M@)wM.h.A...|
+| b8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 07 5a 3d 9b 9c ce c4 b8 21 60 01 ac 95 56 e4 54 |.Z=.....!`...V.T|
+| ea cd 30 7c |..0| |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56836 found (nil)
+association_find: TCP port 4465 found 0x3329410
+
+dissect_ssl enter frame #356 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| dd 3e f4 66 f9 61 9d 1d 08 21 c1 62 e5 32 b5 30 |.>.f.a...!.b.2.0|
+| bd 82 65 ba 66 86 cf 43 09 33 8d 02 0c 31 31 d4 |..e.f..C.3...11.|
+| 6e fa c6 2a b8 88 1f ce 0b 74 5c f8 fd 4e 89 22 |n..*.....t\..N."|
+| eb ab f1 3a eb e4 9b 2b 6f 78 c9 99 1c 92 5c 20 |...:...+ox....\ |
+| bb 71 f1 85 11 af df e0 71 a7 9a bd 4f 51 14 74 |.q......q...OQ.t|
+| d8 6e 9c 02 4e e6 ae 77 29 cf c7 08 59 15 2b 76 |.n..N..w)...Y.+v|
+| 2c 62 6c 43 1c 8e e4 c9 17 c0 53 6e 2f 20 d8 a1 |,blC......Sn/ ..|
+| 12 c0 5b 72 40 9d 7b 9e 2f ac 4f 79 2e 2e dd 45 |..[r@.{./.Oy...E|
+| 84 2d 26 b0 c4 3a 4e ca 97 ef 69 bf d8 97 7b ce |.-&..:N...i...{.|
+| e5 a0 25 24 43 7c 2f 47 a0 17 5b 78 8e ca 01 8c |..%$C|/G..[x....|
+| a2 9c fa fa 08 94 33 96 da 3d b9 ae 49 01 6d 30 |......3..=..I.m0|
+| ea 40 1e 4a 9b 89 d5 df a9 0c bd 16 c9 ac ed a5 |.@.J............|
+| ce e8 7f cd 99 21 cf 62 bc e1 c3 23 a8 07 89 b6 |.....!.b...#....|
+| 9d 7e ca c3 ee 0b ef bf 43 2f 7b e1 16 9b aa 77 |.~......C/{....w|
+| ee 30 f3 21 be 4c ca c7 8a 5c 2d c9 80 bd 16 9f |.0.!.L...\-.....|
+| b6 04 60 5f 39 a3 01 76 f6 c1 15 ce 2f 82 a7 15 |..`_9..v..../...|
+| 5e 5b 58 a8 c2 32 a9 33 3d 4a e2 fd 24 ea d2 18 |^[X..2.3=J..$...|
+| de eb 2d 4f a1 90 53 ac 49 86 bd c1 62 01 40 10 |..-O..S.I...b.@.|
+| 12 59 11 18 a5 ba 33 4b cd c2 1b d4 82 8c 06 cf |.Y....3K........|
+| 60 3d c1 5b 11 3a 02 7d f6 94 42 a5 48 c5 d1 97 |`=.[.:.}..B.H...|
+| b8 db 48 8f 3e 98 f2 98 fd 3a 6b e7 dc 8d ac ce |..H.>....:k.....|
+| f2 db b9 ac 88 59 ca be b4 34 37 69 9b 5b 89 08 |.....Y...47i.[..|
+| bb 3c 4b 27 ec 63 80 57 a2 2f 83 e1 9c 39 03 e8 |.<K'.c.W./...9..|
+| b5 2d 75 e2 dd 0c 7a 10 10 e8 57 5f a1 50 34 d7 |.-u...z...W_.P4.|
+| a4 b1 43 29 c6 6d 87 f0 10 9b 92 41 2d 0b f7 1f |..C).m.....A-...|
+Plaintext[400]:
+| e9 a6 ab 78 e3 ee 73 8e ce ba e2 cc c9 31 10 c6 |...x..s......1..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| df dd 36 53 be 4b 2a cf 0a 54 8d 28 4d d0 04 b9 |..6S.K*..T.(M...|
+| 08 a2 a5 5a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...Z............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f0 53 9d 53 d1 18 af 29 fc eb 69 68 7f 79 c0 f6 |.S.S...)..ih.y..|
+| e8 33 66 a2 |.3f. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4465 found 0x3329410
+
+dissect_ssl enter frame #357 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c8 8e 52 02 bd ce d2 61 53 4d 77 13 e2 40 96 43 |..R....aSMw..@.C|
+| 8f c1 c7 ff 36 8c 11 d7 e4 5a 15 4c e3 5c 55 f1 |....6....Z.L.\U.|
+| e7 f1 01 6a c5 99 be e3 b9 aa 46 83 00 6b 4e f6 |...j......F..kN.|
+Plaintext[48]:
+| 04 e1 12 3e a1 e8 f2 c9 6d 92 92 9a 0b 52 3f f3 |...>....m....R?.|
+| 01 00 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb |..Ae..V.f...,.}.|
+| 17 8e 07 36 0a b1 09 09 09 09 09 09 09 09 09 09 |...6............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb 17 8e |Ae..V.f...,.}...|
+| 07 36 0a b1 |.6.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #359 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 51 75 5c 7b 36 f1 13 5d 48 b0 c7 5b 00 41 13 19 |Qu\{6..]H..[.A..|
+| 76 23 60 e7 84 47 b8 75 02 e6 b6 79 8b fd a0 83 |v#`..G.u...y....|
+| e6 b6 b0 79 22 78 99 6a 4a 84 96 dd 39 12 81 93 |...y"x.jJ...9...|
+Plaintext[48]:
+| d3 8f a5 ef 2f 32 a0 8d b2 9a a1 50 91 a7 6f 52 |..../2.....P..oR|
+| 01 00 ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 |......2.~.#-|.I1|
+| 08 18 ea 38 7c 53 09 09 09 09 09 09 09 09 09 09 |...8|S..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 08 18 |....2.~.#-|.I1..|
+| ea 38 7c 53 |.8|S |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #364 (first time)
+ssl_session_init: initializing ptr 0x7facc38474f0 size 688
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47180 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4470
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #366 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u|
+| cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.|
+| 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=|
+| 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 |
+hash out[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+PRF out[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+key expansion[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+Client MAC key[20]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 |r..% |
+Server MAC key[20]:
+| 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 a7 8f 41 03 |{.T.]D4..T....A.|
+| e9 93 27 bc |..'. |
+Client Write key[16]:
+| 9d 6b 12 30 1c 83 09 e4 a3 43 66 3e a5 fd 38 bf |.k.0.....Cf>..8.|
+Server Write key[16]:
+| 93 58 00 eb 36 6c 2c b3 9a 74 e3 7f bc b3 0c 1a |.X..6l,..t......|
+Client Write IV[16]:
+| 6a 2b 62 83 c0 5a 36 de 50 3b 19 5f 65 0c 6c fa |j+b..Z6.P;._e.l.|
+Server Write IV[16]:
+| b1 15 af 88 ba 6a d2 66 db 34 79 4e b3 9c 6f d9 |.....j.f.4yN..o.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #368 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d9035104154...
+looking for RSA pre-mastera08f474c2a890fc66f808400c49cc26c2804ab7db0a99844...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u|
+| cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.|
+| 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=|
+| 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 |
+hash out[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+PRF out[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+key expansion[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+Client MAC key[20]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef |rox. |
+Server MAC key[20]:
+| c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 fc 56 c8 01 |.r....!.#,...V..|
+| ac 8d d6 c1 |.... |
+Client Write key[16]:
+| bf 4e 2c c4 72 43 70 ea d0 b9 89 95 51 41 a8 27 |.N,.rCp.....QA.'|
+Server Write key[16]:
+| 68 1b 3b d2 8c 6b 70 73 e4 01 07 8e 68 8a 9f 09 |h.;..kps....h...|
+Client Write IV[16]:
+| ea 32 9d fb 23 54 37 bb d3 c8 ee db 13 f2 47 b7 |.2..#T7.......G.|
+Server Write IV[16]:
+| 3d 5d 77 94 97 f9 15 81 05 99 dd 6a 67 6a 9f 05 |=]w........jgj..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cd 79 dc 6f 62 fe 21 70 42 98 f6 48 e3 dd 80 71 |.y.ob.!pB..H...q|
+| f6 3f f8 59 ae 63 9d f0 69 7b 35 0d 8d d0 f0 28 |.?.Y.c..i{5....(|
+| df 91 4b 54 d7 76 fb d8 e7 5c 84 b0 a8 0f 6f af |..KT.v...\....o.|
+| 32 0d 65 32 a3 dd df 69 7d d3 79 c2 9c 2f 42 a5 |2.e2...i}.y../B.|
+Plaintext[64]:
+| 75 c8 e5 2e 3b 86 34 97 78 25 d2 5e 11 76 82 d4 |u...;.4.x%.^.v..|
+| 14 00 00 0c 88 2d 25 c6 b2 df f9 6e 7b a6 86 5d |.....-%....n{..]|
+| e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I|
+| 7e ca fe 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |~...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I|
+| 7e ca fe 05 |~... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #369 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f1 0a f2 a7 2e cc 2e 26 d7 f4 5c eb fd bc d6 ee |.......&..\.....|
+| b6 5a 36 1f 57 05 a1 72 a3 50 cc 99 df 24 2a 1b |.Z6.W..r.P...$*.|
+| e6 95 35 30 b1 5a 6a f1 84 2d e0 89 e8 95 0a c7 |..50.Zj..-......|
+| 47 08 e8 27 ab 7b 3d 3e a9 80 f9 0a 7d 1c 27 56 |G..'.{=>....}.'V|
+Plaintext[64]:
+| 9d e9 d9 96 dd a2 da 36 b5 13 46 ca 82 cd c3 21 |.......6..F....!|
+| 14 00 00 0c 86 b5 73 c1 67 fb a0 66 d0 7f b5 c5 |......s.g..f....|
+| 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...|
+| 8d fd a0 4e 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...N............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...|
+| 8d fd a0 4e |...N |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #370 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 68 4a b6 73 42 99 a4 45 24 9b eb 56 6e 8d d8 a0 |hJ.sB..E$..Vn...|
+| 27 bc f4 56 84 c5 bc b3 df 25 60 80 3f fb be d4 |'..V.....%`.?...|
+| b7 f4 33 ed 5d 4b e1 06 cb b7 9b cd d8 04 d2 79 |..3.]K.........y|
+| d4 3e 1b c9 cf db 06 96 56 64 aa 35 0e 2a 33 1c |.>......Vd.5.*3.|
+| 81 bb 4a 37 60 b7 47 7f dc 45 c8 ba 7a 59 6e fb |..J7`.G..E..zYn.|
+| e1 1c e0 c3 f9 f0 5d d0 9d f0 a3 17 cb de 05 94 |......].........|
+| 82 94 03 81 26 51 0e 5e 8e 2f 41 00 fd 90 58 88 |....&Q.^./A...X.|
+Plaintext[112]:
+| d6 f4 8d 74 4f a9 b4 d7 46 26 79 2b a1 bb f5 d7 |...tO...F&y+....|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a 03 a3 |yn.nl:4470......|
+| 54 92 72 54 37 8d ad 36 33 26 d3 0e 22 e3 ce c5 |T.rT7..63&.."...|
+| 34 d4 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |4...............|
+ssl_decrypt_record found padding 13 final len 98
+checking mac (len 62, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3c 35 f7 17 1d ca 6f e5 3b b6 d6 90 9e cb af f4 |<5....o.;.......|
+| 49 f6 4b 4c |I.KL |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47180 found (nil)
+association_find: TCP port 4470 found 0x33cdf40
+
+dissect_ssl enter frame #371 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fa d6 df 69 e5 8b 28 37 ec b4 85 9c 85 99 03 cd |...i..(7........|
+| e1 06 72 7e fe 3b 55 39 53 a5 c3 12 53 b7 50 43 |..r~.;U9S...S.PC|
+| 22 39 a5 c5 d9 f5 e4 10 ca 36 e3 23 e9 f0 52 c0 |"9.......6.#..R.|
+| c9 d7 4e 62 a7 41 49 46 a0 87 3f 93 bc 2e d1 6a |..Nb.AIF..?....j|
+| 15 f7 1f 76 54 41 74 89 28 b9 9d f9 7e 50 91 a7 |...vTAt.(...~P..|
+| 65 cc a2 b5 7e d1 0e 2c 54 bf 4b f6 06 bb 78 d7 |e...~..,T.K...x.|
+| d5 4d 82 21 f9 41 3a 6c fa c4 20 4b 55 b1 a5 c5 |.M.!.A:l.. KU...|
+| e0 50 92 f3 e2 03 e4 2b 90 8c 50 f7 b5 ef 1a 16 |.P.....+..P.....|
+| ea c2 7f 2b a2 a0 d8 ae bc 0b 8f 39 c9 9b ad 93 |...+.......9....|
+| 8d ca cf 99 e7 58 a7 98 1c fd a8 e4 ac d1 c0 ac |.....X..........|
+| c8 b4 a6 ea 4d 12 34 9b 1e 73 ed 25 62 df 91 47 |....M.4..s.%b..G|
+| da 5a 4d be 04 b3 d0 e9 d6 8f 2e bf 91 01 59 68 |.ZM...........Yh|
+| e6 9d 96 74 64 a3 84 dd 9d 1b 1d 8e 37 ef b4 8f |...td.......7...|
+| 8d 74 65 45 74 35 6e a0 00 b0 fe d4 48 38 3f 95 |.teEt5n.....H8?.|
+| 2f ad 20 d8 2e 30 79 2f 0f 26 8d 11 a6 35 bf 30 |/. ..0y/.&...5.0|
+| 8b 6a f3 17 bf 50 c6 53 74 44 5e d5 55 4f 64 46 |.j...P.StD^.UOdF|
+| 17 57 ca 1e 2a ad 5f 07 a4 df 91 3d af 66 54 69 |.W..*._....=.fTi|
+| ec e8 a2 e4 1a f1 3a 93 9c 23 3d 07 8b 51 f8 72 |......:..#=..Q.r|
+| 61 56 16 a9 79 87 09 f6 d7 16 a6 bb f3 9d fd e9 |aV..y...........|
+| e1 ad 5c 5f da fb fb 28 b9 da ec b9 cb 94 71 86 |..\_...(......q.|
+| 4f 5f bd d6 6d cd 83 44 55 4e 6f b0 fd eb 57 ed |O_..m..DUNo...W.|
+| df bc 1b fb c2 53 d0 20 0e 2c fc e8 16 e1 e7 c4 |.....S. .,......|
+| ba f0 51 3b 25 94 13 61 b0 de 39 14 ca a9 a4 f3 |..Q;%..a..9.....|
+| 93 44 1f 92 45 56 01 cf 55 c1 0f 94 7e e3 90 aa |.D..EV..U...~...|
+| 8a 1a de 0f 84 ad 4c 6a 50 8c 04 f3 7c ea ec 55 |......LjP...|..U|
+Plaintext[400]:
+| 3c d3 5c f5 f3 f1 a3 70 18 cf 03 31 81 3f 6b 8d |<.\....p...1.?k.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-|
+| 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ff fb 5d c9 |nl'</script>..].|
+| 6b 40 e2 98 6c b4 36 d8 4e f5 dc 4b b6 1c dc c6 |k@..l.6.N..K....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 17 da a6 c8 e4 c3 71 ee 5d 95 dc 2f 2e 61 92 85 |......q.]../.a..|
+| 88 69 73 be |.is. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4470 found 0x33cdf40
+
+dissect_ssl enter frame #372 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 29 d1 08 9f 3d 50 58 b8 93 19 50 63 17 f3 74 aa |)...=PX...Pc..t.|
+| 66 d0 fb b3 3e b5 82 e6 ab 09 c7 87 60 41 55 d3 |f...>.......`AU.|
+| 65 fc d7 d8 ec ac 55 22 f7 62 85 de 5e f0 41 cf |e.....U".b..^.A.|
+Plaintext[48]:
+| df 60 4b 7a 98 c5 58 04 db a4 d9 da a8 99 7e 22 |.`Kz..X.......~"|
+| 01 00 de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c |....E.T.!..vj...|
+| 6c 8a 69 44 59 48 09 09 09 09 09 09 09 09 09 09 |l.iDYH..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c 6c 8a |..E.T.!..vj...l.|
+| 69 44 59 48 |iDYH |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #374 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 78 f0 bb 1a 01 43 9e d6 0b 7c 86 c9 8e 7f ab 74 |x....C...|.....t|
+| c2 2e ad 47 19 29 7d e1 65 28 c7 88 4a 79 a5 80 |...G.)}.e(..Jy..|
+| f0 01 ea c4 e7 e5 5e 37 e7 3e 38 06 89 e2 59 56 |......^7.>8...YV|
+Plaintext[48]:
+| 14 9f f6 9d 8b 3b a1 96 25 5e c2 de 2d 63 cd d2 |.....;..%^..-c..|
+| 01 00 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b |..S..K ......>.+|
+| c5 f9 5a f4 da 38 09 09 09 09 09 09 09 09 09 09 |..Z..8..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b c5 f9 |S..K ......>.+..|
+| 5a f4 da 38 |Z..8 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #379 (first time)
+ssl_session_init: initializing ptr 0x7facc3849ab0 size 688
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60473 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4471
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #381 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........|
+| c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.|
+| 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....|
+| a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. |
+hash out[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+PRF out[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+key expansion[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+Client MAC key[20]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d |...- |
+Server MAC key[20]:
+| 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 ad 35 e1 1c |.H.K..5....x.5..|
+| db 56 e9 82 |.V.. |
+Client Write key[16]:
+| 70 1c 36 6f 88 ae 80 0d c7 1b a9 4b 1c ae 21 8c |p.6o.......K..!.|
+Server Write key[16]:
+| 46 ca 70 dd d9 22 f3 1d 97 bc 64 b2 6a af 24 bb |F.p.."....d.j.$.|
+Client Write IV[16]:
+| 32 8c b6 9a be 40 fb fd 89 a4 e7 88 11 eb f4 03 |2....@..........|
+Server Write IV[16]:
+| bf b2 c3 a2 08 5b 76 6e a1 1a 51 b7 c4 e7 21 9e |.....[vn..Q...!.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #383 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f227...
+looking for RSA pre-master0080925605454b9461199474e97c5f8964d84e2a5400fc5d...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........|
+| c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.|
+| 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....|
+| a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. |
+hash out[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+PRF out[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+key expansion[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+Client MAC key[20]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 |..&. |
+Server MAC key[20]:
+| c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 44 e4 7c 70 |....i....i.(D.|p|
+| 3a 85 4f 59 |:.OY |
+Client Write key[16]:
+| 04 15 14 3e 42 6b fd a4 b4 e9 d4 6e d7 19 06 1f |...>Bk.....n....|
+Server Write key[16]:
+| a3 fe 96 1d 1d 6d 8a fa 0e d2 6a da 98 44 0e b0 |.....m....j..D..|
+Client Write IV[16]:
+| cb 8c a8 48 21 79 92 d1 a7 8b 66 50 43 1c 12 3c |...H!y....fPC..<|
+Server Write IV[16]:
+| 3c 6c b8 08 b4 e7 5c 8a 52 0e ad 3d 4d c2 44 6a |<l....\.R..=M.Dj|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| ff fa 82 b0 4d 30 fe 55 33 2f 68 3c a2 4f 8b 45 |....M0.U3/h<.O.E|
+| 0c a0 90 8c 9a 8a 1e b7 76 cd 38 c0 a8 e9 a3 0b |........v.8.....|
+| 6d ac 88 95 50 c1 c5 9c c3 69 ef d9 7c bd d3 8e |m...P....i..|...|
+| 91 a3 60 5d 8e fc b6 b6 93 7c db 9a 59 ba f4 06 |..`].....|..Y...|
+Plaintext[64]:
+| fc f0 34 98 a0 90 d3 43 7b 98 e4 5f c5 9f 40 ce |..4....C{.._..@.|
+| 14 00 00 0c 25 8d d0 f4 43 f4 19 c7 70 b6 b4 72 |....%...C...p..r|
+| d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV|
+| 0d 3c f3 1d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.<..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV|
+| 0d 3c f3 1d |.<.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #384 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cc 70 11 57 0b f2 6c b9 05 43 60 3d 36 a3 fc e6 |.p.W..l..C`=6...|
+| a2 1d 20 67 b7 3b fc 53 dc 60 45 82 38 cc 1b 21 |.. g.;.S.`E.8..!|
+| 8d d1 32 83 c8 2a 8b 18 39 1e 04 80 74 81 53 44 |..2..*..9...t.SD|
+| 85 36 24 9f 5f 69 67 77 f5 b1 7c 18 06 c8 fe f8 |.6$._igw..|.....|
+Plaintext[64]:
+| c8 6b 4d 2b 1b 1c 96 d4 fb 98 5a b0 ff 7e 3f 79 |.kM+......Z..~?y|
+| 14 00 00 0c cc 5e 9b 8a 33 ee 1a 9f a2 82 d0 e8 |.....^..3.......|
+| c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...|
+| 53 f0 48 5d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |S.H]............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...|
+| 53 f0 48 5d |S.H] |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #385 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| c1 81 85 64 bb 14 3a 97 60 53 86 5e c8 9a 0c 0a |...d..:.`S.^....|
+| 68 87 74 3d 5f 3d 0e 66 ea bc c6 00 15 7a 7a c5 |h.t=_=.f.....zz.|
+| ca ae 14 01 92 a3 7e ee 19 a4 b3 55 02 eb 82 23 |......~....U...#|
+| 76 bb 48 c9 02 f0 20 48 72 ba f7 0f af ea d7 a2 |v.H... Hr.......|
+| 7f 3d b3 34 8f be 50 2c 98 15 18 ec 5d ab 65 66 |.=.4..P,....].ef|
+| a3 e7 f2 27 3a 79 6a 32 be 9c cc 64 ea 9d 4f 50 |...':yj2...d..OP|
+| 87 b2 94 80 1f 05 f5 4d 40 33 ac e4 58 34 5b ca |.......M@3..X4[.|
+Plaintext[112]:
+| f4 97 05 81 29 29 0f cc f5 ab 32 b4 73 2d b1 5a |....))....2.s-.Z|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 31 0d 0a 0d 0a 0e 3a 04 3b 3b f8 a8 df d4 b4 |71.....:.;;.....|
+| 88 aa d0 77 2a dc ac 4b ac 12 05 05 05 05 05 05 |...w*..K........|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d b4 26 3e bf 0e 09 4c 6d a5 46 ed 83 88 23 bd |..&>...Lm.F...#.|
+| 05 43 5f 20 |.C_ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60473 found (nil)
+association_find: TCP port 4471 found 0x33cdfd0
+
+dissect_ssl enter frame #386 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 75 c6 d3 7c b8 4d 66 cc fd 0e ed 2f 37 3f 64 04 |u..|.Mf..../7?d.|
+| 6f 75 bf 54 5d a0 eb 02 7f 23 75 4f 2c 1c 26 d3 |ou.T]....#uO,.&.|
+| 3c db e8 c2 69 b2 d6 de 21 20 22 6e e2 7e e4 fc |<...i...! "n.~..|
+| f3 1d 5a 8a 59 12 96 42 1d ad e0 87 b8 0e fb 86 |..Z.Y..B........|
+| 3f ff dd b3 98 42 c3 98 27 df 79 b9 d9 bb b5 bb |?....B..'.y.....|
+| 3b d6 cd 23 fc a7 67 a8 cb 76 c0 30 ce bc 3a 8b |;..#..g..v.0..:.|
+| 62 82 0d 72 ef 85 e8 81 9e 30 6d 89 4f c0 b2 d1 |b..r.....0m.O...|
+| 2d ac f2 40 1c 94 87 1d 7b aa 28 d2 f9 dc f2 41 |-..@....{.(....A|
+| 82 7f be b6 84 c3 30 e6 9f 6d 3a c0 bd 7f 72 44 |......0..m:...rD|
+| 31 ef 41 8f 99 9f a0 1e 63 01 d6 55 12 f6 d7 a4 |1.A.....c..U....|
+| aa 25 6d d4 31 fc 23 f8 55 20 6e 8d 0d 16 53 de |.%m.1.#.U n...S.|
+| 96 cb 5d 8b 9f 6e 96 cf ff f1 ad 24 ac f4 06 49 |..]..n.....$...I|
+| b2 c6 86 a0 d6 50 7e e1 3c fb fb ca bc 05 c9 7b |.....P~.<......{|
+| 03 11 de a3 14 ff 96 9d 67 6c 2e 2a 36 95 c3 4c |........gl.*6..L|
+| c2 d7 3b b0 cd 62 b5 6b 3c 51 07 c4 61 ab 75 45 |..;..b.k<Q..a.uE|
+| ff 9e 7c 2f 79 a7 f9 df 15 f7 02 97 31 a4 ad 83 |..|/y.......1...|
+| 3a 7b 5a 2d 9b ec 1f ad 98 12 be 81 57 8e 64 ff |:{Z-........W.d.|
+| 25 15 00 cb d3 01 21 7d ea 9a 29 65 7f 32 fb ea |%.....!}..)e.2..|
+| bd 39 67 4d 3a c7 88 89 81 f6 74 de 81 a0 44 56 |.9gM:.....t...DV|
+| 39 36 cb 39 64 b2 00 1c b4 7a f3 58 b3 f2 6d 55 |96.9d....z.X..mU|
+| 7f 63 4f 79 ba ed f3 d9 b4 20 11 69 2e 8f c4 8b |.cOy..... .i....|
+| e9 09 2f f0 73 2c af 05 10 7d 1e c3 e5 fe fa 65 |../.s,...}.....e|
+| 50 7a ee 76 6f 15 f9 5a ba c8 d4 ee a3 24 a2 7d |Pz.vo..Z.....$.}|
+| cd 1a 37 fe ed 91 6e 83 9d ab 2c 36 8f 5b 8a e1 |..7...n...,6.[..|
+| 52 ec a3 3e 99 c0 82 17 d1 be dc 45 94 49 2c bb |R..>.......E.I,.|
+Plaintext[400]:
+| 7c 8f 27 4e 03 ee 85 93 f7 84 8c 63 b1 ce 76 b9 ||.'N.......c..v.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D|
+| 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d1 4b 51 f6 |nl'</script>.KQ.|
+| c3 46 f0 aa dd 25 f0 d7 8e 38 f6 d5 1c aa 18 fc |.F...%...8......|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 94 66 a7 19 1d 91 b9 b4 22 ed ff 59 95 af c0 15 |.f......"..Y....|
+| 86 55 bf a3 |.U.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4471 found 0x33cdfd0
+
+dissect_ssl enter frame #387 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d8 68 1f b9 e4 9b 0e 10 d9 e3 a4 30 b4 95 28 96 |.h.........0..(.|
+| 1d 06 0e 7c 68 38 00 b8 8f 16 94 92 3e f8 63 0e |...|h8......>.c.|
+| 2d 27 a7 ff 18 36 bf c4 d6 6b 97 3e 7e 30 89 ab |-'...6...k.>~0..|
+Plaintext[48]:
+| 60 d1 c3 db e5 ef d9 6b 2d 2b 9e e4 93 15 09 66 |`......k-+.....f|
+| 01 00 cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f |.....P...n.E.).O|
+| 65 10 31 4f 32 2d 09 09 09 09 09 09 09 09 09 09 |e.1O2-..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f 65 10 |...P...n.E.).Oe.|
+| 31 4f 32 2d |1O2- |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #389 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d6 cc 07 ba ea 03 7d 68 7c f0 7b ce 4a b4 ed 5b |......}h|.{.J..[|
+| bd e7 c5 32 ff 88 d6 b4 6e af ad 92 9d fe ec 41 |...2....n......A|
+| d2 8f 4c de 30 90 7b 28 7a 1b 1d 96 c7 42 e4 c5 |..L.0.{(z....B..|
+Plaintext[48]:
+| 02 bc 99 84 e6 6f 25 d5 5a 8a bb d5 6c 5e f2 d7 |.....o%.Z...l^..|
+| 01 00 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 |..l3:j>..,o..q.E|
+| a2 fd 84 e0 39 58 09 09 09 09 09 09 09 09 09 09 |....9X..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 a2 fd |l3:j>..,o..q.E..|
+| 84 e0 39 58 |..9X |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #394 (first time)
+ssl_session_init: initializing ptr 0x7facc384bfb0 size 688
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34652 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4472
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #396 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;|
+| e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.|
+| 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.|
+| 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. |
+hash out[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+PRF out[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+key expansion[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+Client MAC key[20]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 |..XR |
+Server MAC key[20]:
+| 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 c3 0e b3 70 |lw.R..}.&.>....p|
+| e5 46 9c ad |.F.. |
+Client Write key[16]:
+| 76 59 4a db 1b 2b e4 45 d0 86 fd 28 55 ad d2 ef |vYJ..+.E...(U...|
+Server Write key[16]:
+| 8a d6 e1 30 cf 8c 7d 18 8e e5 18 af 12 f3 28 0c |...0..}.......(.|
+Client Write IV[16]:
+| f1 72 ce a8 76 d8 69 98 a8 8e 90 31 a0 66 f8 20 |.r..v.i....1.f. |
+Server Write IV[16]:
+| 65 f9 fd 52 17 25 05 79 b3 d3 55 21 7f f3 55 37 |e..R.%.y..U!..U7|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #398 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d567...
+looking for RSA pre-master0080aeb905c19d1a09d1a50bad095bdafcc02622d8b1e32e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.|
+| d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6|
+| ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;|
+| e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.|
+| 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.|
+| 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. |
+hash out[104]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..|
+| 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj|
+| 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..|
+| 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O|
+| da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..|
+| df 08 69 d9 fd 21 06 71 |..i..!.q |
+PRF out[104]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..|
+| 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj|
+| 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..|
+| 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O|
+| da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..|
+| df 08 69 d9 fd 21 06 71 |..i..!.q |
+key expansion[104]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..|
+| 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj|
+| 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..|
+| 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O|
+| da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..|
+| df 08 69 d9 fd 21 06 71 |..i..!.q |
+Client MAC key[20]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea |.z.. |
+Server MAC key[20]:
+| dc 0b f6 11 1b 86 86 08 43 61 e6 db 6c a1 17 65 |........Ca..l..e|
+| 11 6e bb c7 |.n.. |
+Client Write key[16]:
+| 60 4d 62 2a c8 27 4b 6a 2f 48 26 e4 82 97 6a d2 |`Mb*.'Kj/H&...j.|
+Server Write key[16]:
+| 77 42 b2 35 d9 31 c5 f5 51 48 9c 96 59 75 76 c1 |wB.5.1..QH..Yuv.|
+Client Write IV[16]:
+| c9 bf c0 9c dd 7d 00 4f da 16 d1 c1 48 ae 2a af |.....}.O....H.*.|
+Server Write IV[16]:
+| 05 f7 aa 04 32 39 1e 1d df 08 69 d9 fd 21 06 71 |....29....i..!.q|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.|
+| d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6|
+| ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c6 1e 9c 56 50 69 56 72 5e 3b 82 31 0d 3b 39 f1 |...VPiVr^;.1.;9.|
+| ca d5 67 f2 fb 5f d4 cb 76 ea d7 6a c9 0a 26 19 |..g.._..v..j..&.|
+| a9 a7 55 54 41 0a a2 75 34 23 13 54 d1 f6 fd 34 |..UTA..u4#.T...4|
+| 17 9a f9 1f 18 3c 79 42 d0 dc a5 c6 07 b8 1c f6 |.....<yB........|
+Plaintext[64]:
+| bd 46 69 de 0b 31 61 91 2c bb 02 f1 3e 76 4f 13 |.Fi..1a.,...>vO.|
+| 14 00 00 0c 6a 08 e7 c2 d8 18 bf b1 2f 46 54 91 |....j......./FT.|
+| e6 00 f8 1c 63 3b 15 ce 94 4d 7d db e5 84 fc 94 |....c;...M}.....|
+| 2e 19 b6 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...5............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e6 00 f8 1c 63 3b 15 ce 94 4d 7d db e5 84 fc 94 |....c;...M}.....|
+| 2e 19 b6 35 |...5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #399 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| db 8f 6b 7a 27 d9 c3 8e 82 97 d7 1c a0 53 c4 93 |..kz'........S..|
+| ab 65 d1 0a d4 b0 18 ec b3 a8 29 73 95 8e a4 27 |.e........)s...'|
+| e2 ca c1 cc 11 ce 21 3e 09 0b da 12 ee ab 52 de |......!>......R.|
+| c0 66 a6 ba bd fa c4 7d ab e5 a3 01 1e 89 a8 32 |.f.....}.......2|
+Plaintext[64]:
+| a4 7b 6a aa 61 e2 de 95 a4 8f 57 ee 74 36 51 15 |.{j.a.....W.t6Q.|
+| 14 00 00 0c 51 f8 fb d8 09 36 0a ff 22 d1 66 cc |....Q....6..".f.|
+| a8 27 e2 7d 44 1a f7 7d 76 d8 f2 56 b9 4d 76 ed |.'.}D..}v..V.Mv.|
+| 6c 47 8c fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |lG..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a8 27 e2 7d 44 1a f7 7d 76 d8 f2 56 b9 4d 76 ed |.'.}D..}v..V.Mv.|
+| 6c 47 8c fc |lG.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #400 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| ac 3d 05 be 3e 73 a8 b2 60 8e 5e 6c bd 6e 54 23 |.=..>s..`.^l.nT#|
+| c1 99 78 88 ba 42 16 ef 19 42 5b 67 12 bc 39 58 |..x..B...B[g..9X|
+| 00 c9 6c 50 91 1a fc c7 7f 89 4d 05 89 fd 75 e4 |..lP......M...u.|
+| 1e 58 e2 d3 59 4b 94 9c 26 31 8c 84 d3 79 00 f3 |.X..YK..&1...y..|
+| c3 6a af ae 5f cf 60 9a ae ef cb 7f ed 0c 36 8c |.j.._.`.......6.|
+| f0 c6 30 0f e0 ea 66 4a da 06 6c d9 cf f1 8f 5c |..0...fJ..l....\|
+| 55 d7 4f 56 c0 79 ab 14 60 74 ba 7f 8d 33 7e 3b |U.OV.y..`t...3~;|
+Plaintext[112]:
+| 2b c4 90 ec 35 7a 40 8c 4f cd 7b 99 6a b4 b7 46 |+...5z@.O.{.j..F|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 73 65 |Host: dhe-rsa-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 32 0d 0a 0d 0a 31 aa d4 9e ff 86 aa cb a2 02 |72....1.........|
+| 1f 3c 06 b0 26 6f 7d e6 a9 95 05 05 05 05 05 05 |.<..&o}.........|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b1 97 61 f8 c9 3a ea f4 b2 66 f3 ca 33 dc 29 44 |..a..:...f..3.)D|
+| 87 53 fd d9 |.S.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34652 found (nil)
+association_find: TCP port 4472 found 0x33ce060
+
+dissect_ssl enter frame #401 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d6 5e 96 de 32 3d 96 55 34 7e bc 61 09 c3 41 7d |.^..2=.U4~.a..A}|
+| 52 55 1b e0 3e 29 f2 26 f3 d8 99 e2 92 83 c1 7b |RU..>).&.......{|
+| 7b 66 a4 f9 d2 1b 05 69 da 79 fc ac 89 ae 75 e3 |{f.....i.y....u.|
+| f1 a0 e8 8c 8c e9 a7 2f dd ed 8e 32 22 0b df ea |......./...2"...|
+| d9 30 aa 2a 18 a7 20 7a c1 0c 6a 9c 2e 1d 45 01 |.0.*.. z..j...E.|
+| 59 38 94 d2 84 29 31 8e 9a b3 2d 00 83 cd f6 39 |Y8...)1...-....9|
+| fb 08 26 87 ab 35 c7 1d 1a df 9e bc 1f 5b dd 41 |..&..5.......[.A|
+| 21 62 e8 94 d3 10 99 78 e7 2a c8 d0 1c 00 a2 1d |!b.....x.*......|
+| c4 d1 5f a8 3e af 98 fc 82 a2 62 8b 00 56 97 65 |.._.>.....b..V.e|
+| ed 38 2e 9f 33 cf 2a 19 40 94 1e 28 5b e2 66 d9 |.8..3.*.@..([.f.|
+| 15 c9 f1 65 78 27 ba f3 68 44 8e af da f3 b1 66 |...ex'..hD.....f|
+| f0 34 be 14 f2 df 86 bd a2 58 3d f7 9a 95 48 62 |.4.......X=...Hb|
+| 24 8e 16 4d ca 4d 98 db d9 92 61 a5 a3 35 bf 2c |$..M.M....a..5.,|
+| af 9a 36 1c fd da 7a 30 49 09 7a f1 e2 c8 fd 43 |..6...z0I.z....C|
+| d5 1d 01 98 ee c6 8e 2d bd 9c 15 27 11 a6 e4 4f |.......-...'...O|
+| 6f 3e a3 63 83 46 2b d2 f0 23 21 fb 05 71 a5 8f |o>.c.F+..#!..q..|
+| 54 ef 26 19 49 a9 4b 46 88 12 27 91 41 0b e1 f5 |T.&.I.KF..'.A...|
+| 48 43 f2 8b d4 dd 39 08 bf 68 3d 3f 90 1c 4c aa |HC....9..h=?..L.|
+| 0e e4 bb 6a 74 02 e0 22 2c 99 25 5f be a1 a6 1e |...jt..",.%_....|
+| de ab 66 b3 32 63 7f 6f bb 3b bf db c8 71 74 e3 |..f.2c.o.;...qt.|
+| 70 30 d6 17 d5 1e ab bf 6b ea 85 be 3d a3 1e 1b |p0......k...=...|
+| df fa e3 d9 16 0d dc 7e 9f 90 19 b0 da c3 33 1c |.......~......3.|
+| be c4 63 29 f2 8e f9 ab 32 b7 72 78 ae 1d aa 00 |..c)....2.rx....|
+| e9 f6 c4 b8 ed 5b 0f 9f fe 57 81 33 2e 6b 78 39 |.....[...W.3.kx9|
+| 99 46 97 1c 6d 9d c4 0b b6 2d 02 ac db 5a 51 8a |.F..m....-...ZQ.|
+Plaintext[400]:
+| 4f a3 84 9e 81 10 fb 5e 35 86 8b 98 1d e8 5c 2e |O......^5.....\.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R|
+| 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 75 d8 34 78 |nl'</script>u.4x|
+| c5 1f bb 12 9e af 9b cb 49 d3 43 c6 de 3a 02 8b |........I.C..:..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 97 45 05 4e 98 d6 1f 6b 78 d4 4a ad 94 e3 f8 c4 |.E.N...kx.J.....|
+| d4 f8 08 1d |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4472 found 0x33ce060
+
+dissect_ssl enter frame #402 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 92 19 19 b5 dc ab 59 18 e4 dc 2f c3 3f 66 76 bb |......Y.../.?fv.|
+| 4d 6d ab 0e 31 0b 1e e7 69 9e 73 e5 0e 95 93 79 |Mm..1...i.s....y|
+| a2 b2 57 d8 93 b0 28 0b 42 f0 31 05 29 4c 48 79 |..W...(.B.1.)LHy|
+Plaintext[48]:
+| 20 9f b0 76 a7 0d 9e a7 ad be c3 35 f7 21 08 9f | ..v.......5.!..|
+| 01 00 e3 d2 19 73 66 1a 3f 1e ca d7 7d 2a 51 c7 |.....sf.?...}*Q.|
+| 2f 28 c8 0f 53 ba 09 09 09 09 09 09 09 09 09 09 |/(..S...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 d2 19 73 66 1a 3f 1e ca d7 7d 2a 51 c7 2f 28 |...sf.?...}*Q./(|
+| c8 0f 53 ba |..S. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #404 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2f 4c 6a a7 3c d8 02 04 18 81 7c 7c f5 e1 c8 59 |/Lj.<.....||...Y|
+| ed 7c c9 ab d2 82 29 9a f9 e5 bb 3a d7 d0 00 68 |.|....)....:...h|
+| d4 02 d5 f9 05 b6 d7 ee 56 c5 03 0d 09 47 a8 40 |........V....G.@|
+Plaintext[48]:
+| a0 ad a1 9a 91 87 b3 e1 af b7 56 0d 19 b6 d9 31 |..........V....1|
+| 01 00 09 27 fb e5 72 af e4 bf c1 bc ff 11 80 cb |...'..r.........|
+| 28 64 72 8a 63 9a 09 09 09 09 09 09 09 09 09 09 |(dr.c...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 09 27 fb e5 72 af e4 bf c1 bc ff 11 80 cb 28 64 |.'..r.........(d|
+| 72 8a 63 9a |r.c. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #409 (first time)
+ssl_session_init: initializing ptr 0x7facc384e4b0 size 688
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34183 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4479
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #411 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC002 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.|
+| d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6|
+| ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 28 0c 4e 7b 0e 4e 70 ca 6f 36 b8 b1 fe c0 6d |%(.N{.Np.o6....m|
+| ac 16 f7 77 60 aa 7c 9e 8a 15 ab e5 f5 52 34 bf |...w`.|......R4.|
+| 25 06 e0 8e a2 a0 d6 d2 58 17 2d ce 2e 54 0d a6 |%.......X.-..T..|
+| c3 c6 40 1c af f3 d7 c4 6d 2b f4 26 51 |..@.....m+.&Q |
+hash out[72]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.|
+| e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y|
+| 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.|
+| 95 40 f7 29 f8 38 e2 21 |.@.).8.! |
+PRF out[72]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.|
+| e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y|
+| 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.|
+| 95 40 f7 29 f8 38 e2 21 |.@.).8.! |
+key expansion[72]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.|
+| e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y|
+| 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.|
+| 95 40 f7 29 f8 38 e2 21 |.@.).8.! |
+Client MAC key[20]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 |.8.! |
+Server MAC key[20]:
+| 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 e5 e6 cb cc |*.........}.....|
+| 9f 18 43 92 |..C. |
+Client Write key[16]:
+| cd a0 f6 6a b0 af 87 79 2a a3 ef 6f f4 3c 5d 65 |...j...y*..o.<]e|
+Server Write key[16]:
+| 3f c3 eb 52 d6 c2 4d 1a 95 40 f7 29 f8 38 e2 21 |?..R..M..@.).8.!|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #413 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caf...
+looking for RSA pre-master6104408dff00e6a69e942bbca1848c290b3173ca6a797944...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b|
+| 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.|
+| e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 28 0c 4e 7b 0e 4e 70 ca 6f 36 b8 b1 fe c0 6d |%(.N{.Np.o6....m|
+| ac 16 f7 77 60 aa 7c 9e 8a 15 ab e5 f5 52 34 bf |...w`.|......R4.|
+| 25 06 e0 8e a2 a0 d6 d2 58 17 2d ce 2e 54 0d a6 |%.......X.-..T..|
+| c3 c6 40 1c af f3 d7 c4 6d 2b f4 26 51 |..@.....m+.&Q |
+hash out[72]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C|
+| ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.|
+| 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..|
+| ec 5f 1d d8 0e d6 ec 11 |._...... |
+PRF out[72]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C|
+| ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.|
+| 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..|
+| ec 5f 1d d8 0e d6 ec 11 |._...... |
+key expansion[72]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C|
+| ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.|
+| 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..|
+| ec 5f 1d d8 0e d6 ec 11 |._...... |
+Client MAC key[20]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 |n... |
+Server MAC key[20]:
+| 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 ae 80 93 ee |h2..5.....3C....|
+| bf e0 f6 e1 |.... |
+Client Write key[16]:
+| bb ef de 91 9c bf 46 fa 82 2c 88 0a c4 86 e7 44 |......F..,.....D|
+Server Write key[16]:
+| 47 0d af 08 c7 77 13 b6 ec 5f 1d d8 0e d6 ec 11 |G....w..._......|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 bd 73 03 00 00 00 00 |@.s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b|
+| 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.|
+| e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| b2 ea 4b a9 c3 7a ae 92 00 3a c0 4e e8 0c 5e 87 |..K..z...:.N..^.|
+| 6c 1c f0 4d 9c 6c 07 9a dd c8 a9 c5 5a 62 06 81 |l..M.l......Zb..|
+| b4 b9 93 b9 |.... |
+Plaintext[36]:
+| 14 00 00 0c 75 5f fb 5f 7d 83 4e b3 99 6a 0d 6c |....u_._}.N..j.l|
+| ce b7 bf 51 2e 45 65 9a ef bb a1 d0 41 11 0e 3a |...Q.Ee.....A..:|
+| 87 b9 3f f9 |..?. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ce b7 bf 51 2e 45 65 9a ef bb a1 d0 41 11 0e 3a |...Q.Ee.....A..:|
+| 87 b9 3f f9 |..?. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #414 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| e3 0e 63 dc 28 8a ef 67 d2 56 17 8f 2e f8 e4 3c |..c.(..g.V.....<|
+| 1b 65 76 d4 1a 06 bb d0 1a 4a d4 7a b2 42 25 fc |.ev......J.z.B%.|
+| 49 20 b2 82 |I .. |
+Plaintext[36]:
+| 14 00 00 0c cb ad 8d 7a fd c5 52 dd ea 0d 5d f3 |.......z..R...].|
+| 30 21 6c 30 41 33 94 32 87 4f db db 77 4b 7c 25 |0!l0A3.2.O..wK|%|
+| 54 ed bb 0d |T... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 30 21 6c 30 41 33 94 32 87 4f db db 77 4b 7c 25 |0!l0A3.2.O..wK|%|
+| 54 ed bb 0d |T... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #415 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 97
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 92, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 92
+Ciphertext[92]:
+| 37 81 57 36 d9 41 a4 b7 a7 40 e3 ba eb b3 b4 57 |7.W6.A...@.....W|
+| 25 df 83 6e c0 72 67 6b 34 a7 cc 5c 33 e9 0d 07 |%..n.rgk4..\3...|
+| 10 d3 a2 43 10 96 6a c7 b7 9a 1c b8 2d 46 90 51 |...C..j.....-F.Q|
+| 82 29 71 dd 6f 7f c1 42 22 99 d7 c6 ca dd 40 78 |.)q.o..B".....@x|
+| 8f d8 9b fe d2 f1 2a e6 92 bb c4 c4 fe 81 6b 2e |......*.......k.|
+| de 70 6b 8f f3 df c1 36 5a 03 92 c2 |.pk....6Z... |
+Plaintext[92]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a 6c 7d 56 2f 88 41 10 14 |4479....l}V/.A..|
+| 2d ba 2a ca b1 a4 80 06 0d 5b 2a 7f |-.*......[*. |
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 7d 56 2f 88 41 10 14 2d ba 2a ca b1 a4 80 06 |l}V/.A..-.*.....|
+| 0d 5b 2a 7f |.[*. |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 34183 found (nil)
+association_find: TCP port 4479 found 0x3430b70
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a |4479.... |
+dissect_ssl3_record found association 0x3430b70
+
+dissect_ssl enter frame #416 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 375
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 370, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 370
+Ciphertext[370]:
+| 81 3a 61 c1 4d ce c0 99 59 75 42 ae 68 a8 02 5e |.:a.M...YuB.h..^|
+| 70 23 65 b0 85 19 11 d8 85 70 14 6b e5 1b 8b 38 |p#e......p.k...8|
+| 23 f4 29 af ac 5d 90 9d 99 2c 01 5e d5 b1 96 4d |#.)..]...,.^...M|
+| 4c b2 99 8e bb 39 22 30 10 28 d2 37 95 25 04 c1 |L....9"0.(.7.%..|
+| 44 08 73 60 5e 23 6c 63 b7 63 79 73 c2 0c c1 d4 |D.s`^#lc.cys....|
+| 39 03 04 4e a4 cc de fe 3e 57 f6 1b 67 a9 f1 31 |9..N....>W..g..1|
+| 9f b6 2a 59 e7 0e 76 4a 96 f9 55 c5 32 fe ca cc |..*Y..vJ..U.2...|
+| 2b 44 81 42 14 85 27 e4 a1 80 c4 55 7c 4d ab 1f |+D.B..'....U|M..|
+| af 62 f0 0b f3 28 c9 8d b0 d4 18 8c 41 b5 a3 dd |.b...(......A...|
+| a1 ff fc 9d bb 52 d5 4c f6 73 be ce e7 3a 3d 98 |.....R.L.s...:=.|
+| 0e c0 85 de 8a e7 13 5c c0 c2 7a 41 a8 06 f6 b8 |.......\..zA....|
+| 36 73 f7 34 e6 62 d1 a7 15 a9 5f fb 89 4c 0d af |6s.4.b...._..L..|
+| 06 b5 46 61 91 f6 c9 ff b4 49 65 23 8f a3 6e e0 |..Fa.....Ie#..n.|
+| bd 11 3d 4a 6e 85 66 b7 ed 51 95 10 e5 a7 15 f1 |..=Jn.f..Q......|
+| 8f 59 33 98 4e 6d 42 6d 1e 7c 9a 9c 1c 63 22 03 |.Y3.NmBm.|...c".|
+| 52 03 8f b1 4f 63 42 41 dc 83 f5 ef 41 e8 13 f8 |R...OcBA....A...|
+| 60 e2 8e 57 9a f9 b3 7c ac c0 a0 cb 36 2a 31 c2 |`..W...|....6*1.|
+| 69 c8 c0 cc 03 6c 99 14 2a ea e0 df de d9 5d 7a |i....l..*.....]z|
+| 3d 09 9e 03 12 01 5f a3 09 47 ea f2 a7 47 cf 66 |=....._..G...G.f|
+| 67 d3 8d 58 9a 0e 77 c1 44 b6 a4 c8 be a5 48 aa |g..X..w.D.....H.|
+| 97 a5 11 bd e8 a7 f3 b2 bb 45 6a fb 31 ef c1 72 |.........Ej.1..r|
+| 0a f6 49 6c 98 28 ff 3d 4e 18 fe 28 0f cb a5 0c |..Il.(.=N..(....|
+| 34 12 e1 2f 85 7a 06 2a 76 72 26 2b b1 56 b0 07 |4../.z.*vr&+.V..|
+| dc 86 |.. |
+Plaintext[370]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 55 18 |n.nl'</script>U.|
+| c9 e6 ac 3e ed 25 b1 26 2c 85 68 32 3d 0b b9 43 |...>.%.&,.h2=..C|
+| 60 37 |`7 |
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 55 18 c9 e6 ac 3e ed 25 b1 26 2c 85 68 32 3d 0b |U....>.%.&,.h2=.|
+| b9 43 60 37 |.C`7 |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4479 found 0x3430b70
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x3430b70
+
+dissect_ssl enter frame #417 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 7b d8 92 2e 47 f6 95 a9 07 9e 5a 34 82 65 30 d8 |{...G.....Z4.e0.|
+| a8 c8 4c 6b ef 8b |..Lk.. |
+Plaintext[22]:
+| 01 00 bd b1 03 9f ac 7b d8 db dd 33 37 ff 25 e0 |.......{...37.%.|
+| 96 79 09 29 30 2b |.y.)0+ |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bd b1 03 9f ac 7b d8 db dd 33 37 ff 25 e0 96 79 |.....{...37.%..y|
+| 09 29 30 2b |.)0+ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #419 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 73 e9 7d 8b 80 b8 88 71 be 58 08 f4 17 e3 26 f9 |s.}....q.X....&.|
+| cf a8 41 f6 66 31 |..A.f1 |
+Plaintext[22]:
+| 01 00 a4 3a bf 4b de d8 f9 4a 82 44 37 1e 99 01 |...:.K...J.D7...|
+| 0e 80 bf db 8d 06 |...... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 3a bf 4b de d8 f9 4a 82 44 37 1e 99 01 0e 80 |.:.K...J.D7.....|
+| bf db 8d 06 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #424 (first time)
+ssl_session_init: initializing ptr 0x7facc3850da0 size 688
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45570 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4480
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #426 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b|
+| 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.|
+| e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 13 8e 82 a2 1f 8e 47 09 de fd e3 48 1d ea c7 |%......G....H...|
+| 39 9e 4b 1b 80 b6 24 a5 c5 5f ab 33 e5 52 34 bf |9.K...$.._.3.R4.|
+| 25 02 42 88 2d 3c 8f 20 bc 8f 3e b6 3f 84 29 ad |%.B.-<. ..>.?.).|
+| 4e ef a1 78 53 30 d2 77 dd 09 12 98 12 |N..xS0.w..... |
+hash out[104]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.|
+| 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9|
+| 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.|
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.|
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+PRF out[104]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.|
+| 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9|
+| 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.|
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.|
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+key expansion[104]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.|
+| 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9|
+| 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.|
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.|
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+Client MAC key[20]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 |.... |
+Server MAC key[20]:
+| 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 89 5a 32 c4 |.8>.M....[+..Z2.|
+| 45 2b f8 d0 |E+.. |
+Client Write key[24]:
+| fc 8c 74 33 5a ba 40 39 3b 7b e6 95 50 2e b7 ae |..t3Z.@9;{..P...|
+| 6b 89 da 67 05 3d 6a 8d |k..g.=j. |
+Server Write key[24]:
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 |...FNUB. |
+Client Write IV[8]:
+| f0 ff 5f b7 1c ba 4f e5 |.._...O. |
+Server Write IV[8]:
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #428 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 166
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa17853...
+looking for RSA pre-master6104bc9ef092887a313a5a0b59d6b695eef1f38fdb5c55d0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.|
+| b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....|
+| 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 13 8e 82 a2 1f 8e 47 09 de fd e3 48 1d ea c7 |%......G....H...|
+| 39 9e 4b 1b 80 b6 24 a5 c5 5f ab 33 e5 52 34 bf |9.K...$.._.3.R4.|
+| 25 02 42 88 2d 3c 8f 20 bc 8f 3e b6 3f 84 29 ad |%.B.-<. ..>.?.).|
+| 4e ef a1 78 53 30 d2 77 dd 09 12 98 12 |N..xS0.w..... |
+hash out[104]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3|
+| 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...|
+| b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.|
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4|
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+PRF out[104]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3|
+| 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...|
+| b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.|
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4|
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+key expansion[104]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3|
+| 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...|
+| b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.|
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4|
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+Client MAC key[20]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e |NH1~ |
+Server MAC key[20]:
+| 27 16 68 6c 9c 81 1c c6 7f 27 87 33 71 f4 fe ab |'.hl.....'.3q...|
+| f2 38 3b 0d |.8;. |
+Client Write key[24]:
+| a0 e3 ee 6f 35 9f f6 13 b1 f0 b7 66 af 01 23 b4 |...o5......f..#.|
+| 02 66 59 6c b6 ff 77 b7 |.fYl..w. |
+Server Write key[24]:
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 |4".DV... |
+Client Write IV[8]:
+| 7c 64 0c b4 ef c5 c8 34 ||d.....4 |
+Server Write IV[8]:
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.|
+| b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....|
+| 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 70 03 37 a1 d3 fd cb dd 99 3f 92 07 04 26 4d 15 |p.7......?...&M.|
+| ef fa 4d 65 62 e0 68 f8 10 45 99 f9 ad e2 4a f4 |..Meb.h..E....J.|
+| 4f e1 cd 9a 6e eb e3 e1 fe 87 3a 55 25 eb 8e f9 |O...n.....:U%...|
+Plaintext[48]:
+| ee 13 49 7c da a6 78 49 14 00 00 0c 67 df ec 09 |..I|..xI....g...|
+| 81 93 13 cb dc 73 a4 98 b8 cc e7 0e a2 f0 46 2b |.....s........F+|
+| c8 3b fc 5c 64 64 0b 61 91 4d b1 ce 03 03 03 03 |.;.\dd.a.M......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b8 cc e7 0e a2 f0 46 2b c8 3b fc 5c 64 64 0b 61 |......F+.;.\dd.a|
+| 91 4d b1 ce |.M.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #429 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d3 f8 94 13 8a 90 79 08 62 84 1f f5 43 12 48 6c |......y.b...C.Hl|
+| da 41 be 03 cc ce 13 33 d7 43 b8 c3 9d 9e 41 63 |.A.....3.C....Ac|
+| f5 d4 ed e1 74 36 69 52 fd df 3f 94 b3 99 79 6c |....t6iR..?...yl|
+Plaintext[48]:
+| 4b 03 56 8f 95 06 11 54 14 00 00 0c 0b 0b 6f a9 |K.V....T......o.|
+| e5 fa e5 21 51 a7 ff 42 a4 2c 9c 8d 4b bc 62 f5 |...!Q..B.,..K.b.|
+| e0 a2 c9 21 a7 3c 2e 0b 6f 70 63 f4 03 03 03 03 |...!.<..opc.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 2c 9c 8d 4b bc 62 f5 e0 a2 c9 21 a7 3c 2e 0b |.,..K.b....!.<..|
+| 6f 70 63 f4 |opc. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #430 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| af a2 41 f7 0e 1c e9 3f 48 81 26 37 5f cb 3c c8 |..A....?H.&7_.<.|
+| 20 2a bd 3c c0 ba 22 00 37 a3 dd a6 dc d0 8e 09 | *.<..".7.......|
+| 03 cf d0 12 d6 d3 ad b1 01 09 cc 86 69 3c 50 af |............i<P.|
+| f2 4c 4b 81 54 fb 3f 76 74 af a5 9a 7e d5 8c c8 |.LK.T.?vt...~...|
+| 35 73 85 34 e0 80 95 a3 85 d2 75 6d 74 5e 4e 9d |5s.4......umt^N.|
+| 0f a1 79 8c 59 0c 9d c2 54 d3 68 72 57 87 8e 56 |..y.Y...T.hrW..V|
+| 99 25 7d a8 47 02 ae 16 20 0a 02 e8 22 02 25 3a |.%}.G... ...".%:|
+Plaintext[112]:
+| 35 af a0 74 26 37 be d3 47 45 54 20 2f 20 48 54 |5..t&7..GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 63 |dh-ecdsa-des-cbc|
+| 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |3-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 38 |ekensteyn.nl:448|
+| 30 0d 0a 0d 0a 1f 1b bd 79 b9 e6 82 6b 89 1b e2 |0.......y...k...|
+| b6 12 ad 62 aa ce e0 d7 27 06 06 06 06 06 06 06 |...b....'.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 00 8a 55 6f d9 a6 bf 0f 8c 71 2c d0 b2 53 3e 54 |..Uo.....q,..S>T|
+| 67 38 db 4a |g8.J |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45570 found (nil)
+association_find: TCP port 4480 found 0x3430c00
+
+dissect_ssl enter frame #431 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 50 de b3 20 d9 ea 40 54 6e cf 50 fb 4e fd e8 21 |P.. ..@Tn.P.N..!|
+| 47 ec 5c 0a 0c a9 d3 53 34 3f f7 6f b1 56 aa ec |G.\....S4?.o.V..|
+| e5 75 c4 c7 25 3a de 33 6e fa 1d 3d 5f b6 a6 c1 |.u..%:.3n..=_...|
+| 11 18 c1 6f eb 16 66 e0 26 a3 7a 59 ed 64 80 af |...o..f.&.zY.d..|
+| d4 55 1b 1e c2 0f 12 33 79 87 06 61 f2 ba 81 f2 |.U.....3y..a....|
+| c8 6a 86 32 0d 2a 46 54 d2 ff a1 c4 e8 52 d7 7d |.j.2.*FT.....R.}|
+| 19 a3 be a9 87 fd a8 60 e3 8d e0 26 b8 ff f4 af |.......`...&....|
+| 0f cf 02 52 2a b8 f8 00 63 14 84 39 6a 59 66 54 |...R*...c..9jYfT|
+| d8 31 36 7c 71 d8 37 0d 45 21 c8 5e 23 11 01 71 |.16|q.7.E!.^#..q|
+| 00 f8 68 49 a8 27 fa 60 a0 d7 02 f2 b6 d5 19 27 |..hI.'.`.......'|
+| fd e4 12 d0 2b 81 c1 18 91 7c 54 9f 78 84 e3 5b |....+....|T.x..[|
+| ea e2 6f d2 03 09 97 6a 27 ec 7c 76 a0 0a 8e 4f |..o....j'.|v...O|
+| 9f 4c 51 2f d4 fc 7e 44 48 42 3f cb 7d fb b0 dd |.LQ/..~DHB?.}...|
+| 2c bf 1e 9b 92 d6 57 ec 5d 07 fe 0b 4f 60 b4 21 |,.....W.]...O`.!|
+| 01 0b c5 a7 e8 83 af 4f 7a c3 e8 9e 70 4f a9 7b |.......Oz...pO.{|
+| cb 66 b2 eb 47 82 5c fb d9 51 d0 f5 c8 09 b7 31 |.f..G.\..Q.....1|
+| 58 3a e9 f7 0c 7b 07 63 52 43 f2 0d d1 cf 5a c7 |X:...{.cRC....Z.|
+| 04 bc c1 56 fa cf 1a e6 58 11 68 2f 65 63 23 54 |...V....X.h/ec#T|
+| dd 8d 80 1e 12 b1 c0 a4 1f 8e e7 1e 0f d9 dc 35 |...............5|
+| a1 0d 67 7d 6b d7 9e 0d 69 22 86 80 1f 41 4d 72 |..g}k...i"...AMr|
+| cc 57 e4 ab a0 88 56 38 a1 cf 78 07 5c c0 f8 e5 |.W....V8..x.\...|
+| 5a 54 7b 0c 9e 1b 92 1b b7 2c 78 a3 99 92 32 af |ZT{......,x...2.|
+| 78 6d 66 43 5b b3 98 dd 56 ec 5a 04 6c fb f0 12 |xmfC[...V.Z.l...|
+| 51 e9 06 8d 26 3d ad b6 36 f4 24 be ec 69 a4 3b |Q...&=..6.$..i.;|
+Plaintext[384]:
+| ec 69 d2 96 bc 0a 7b 78 48 54 54 50 2f 31 2e 31 |.i....{xHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 37 20 47 4d |2013 19:55:17 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 33 |che....0xC0,0x03|
+| 20 2d 20 45 43 44 48 2d 45 43 44 53 41 2d 44 45 | - ECDH-ECDSA-DE|
+| 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 33 |S-CBC3-SHA SSLv3|
+| 20 4b 78 3d 45 43 44 48 2f 45 43 44 53 41 20 41 | Kx=ECDH/ECDSA A|
+| 75 3d 45 43 44 48 20 45 6e 63 3d 33 44 45 53 28 |u=ECDH Enc=3DES(|
+| 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1<sc|
+| 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f |ript>document.do|
+| 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'</s|
+| 63 72 69 70 74 3e 72 35 bf b7 c1 e8 79 87 4b 31 |cript>r5....y.K1|
+| 16 96 1b 8c 35 a9 4e 75 1e 4e 05 05 05 05 05 05 |....5.Nu.N......|
+ssl_decrypt_record found padding 5 final len 378
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 20 53 25 f4 70 8d b9 45 c8 ab 3f 81 0b 85 d7 78 | S%.p..E..?....x|
+| 12 d7 4e 1e |..N. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4480 found 0x3430c00
+
+dissect_ssl enter frame #432 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 05 0f 19 82 1e 06 0a 85 ae 7a c2 b1 84 40 80 6d |.........z...@.m|
+| 32 57 f5 2a 32 54 e0 c2 39 bc ae 60 2e e8 27 44 |2W.*2T..9..`..'D|
+Plaintext[32]:
+| c0 e4 fb 91 41 0e 85 c4 01 00 35 51 58 60 f3 04 |....A.....5QX`..|
+| 37 94 6a 0a 20 38 cc 21 15 7c 5f 15 9b bf 01 01 |7.j. 8.!.|_.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 35 51 58 60 f3 04 37 94 6a 0a 20 38 cc 21 15 7c |5QX`..7.j. 8.!.||
+| 5f 15 9b bf |_... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #434 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2e 13 8b 64 1d b9 64 51 86 e9 dc 9e f5 19 c5 3f |...d..dQ.......?|
+| b1 a6 1d 8b 59 d0 70 17 30 7b a0 d9 8b 1a 43 e4 |....Y.p.0{....C.|
+Plaintext[32]:
+| ce 1a c6 03 0a 75 f5 3b 01 00 05 c2 40 e6 8f fe |.....u.;....@...|
+| 6b 3c ec d2 dd 32 25 13 66 76 03 ce 95 2e 01 01 |k<...2%.fv......|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 05 c2 40 e6 8f fe 6b 3c ec d2 dd 32 25 13 66 76 |..@...k<...2%.fv|
+| 03 ce 95 2e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #439 (first time)
+ssl_session_init: initializing ptr 0x7facc38532c0 size 688
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35291 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4481
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #441 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.|
+| b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....|
+| 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 50 c5 36 e6 fa 6b 21 55 2a 9c d9 4d f3 ae 7e |%P.6..k!U*..M..~|
+| 26 f1 9e 79 f3 a9 8d 35 44 2f 37 3b 6f 52 34 bf |&..y...5D/7;oR4.|
+| 25 d3 23 f9 f2 b3 94 e3 a7 ca 28 a0 8a 38 32 e4 |%.#.......(..82.|
+| b5 c1 cd ba 6b 86 7f 53 c5 69 65 67 00 |....k..S.ieg. |
+hash out[104]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.|
+| 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%|
+| b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8|
+| ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..|
+| e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.|
+| 5f 4d 6b 97 01 04 b6 e2 |_Mk..... |
+PRF out[104]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.|
+| 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%|
+| b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8|
+| ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..|
+| e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.|
+| 5f 4d 6b 97 01 04 b6 e2 |_Mk..... |
+key expansion[104]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.|
+| 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%|
+| b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8|
+| ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..|
+| e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.|
+| 5f 4d 6b 97 01 04 b6 e2 |_Mk..... |
+Client MAC key[20]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 |.jd. |
+Server MAC key[20]:
+| 76 82 96 de 82 80 4c bc 58 9d 24 c4 76 fe b7 6e |v.....L.X.$.v..n|
+| db 4c ef 9a |.L.. |
+Client Write key[16]:
+| 70 0a 0a 63 22 70 fe 25 b9 ec 73 1e c5 2e 38 be |p..c"p.%..s...8.|
+Server Write key[16]:
+| 71 7e 61 ee 8a 6f 52 38 ff ab f2 cd 46 f5 ba 07 |q~a..oR8....F...|
+Client Write IV[16]:
+| 57 78 9e 14 e8 53 92 bf e9 1f 6d af e2 3b 49 cf |Wx...S....m..;I.|
+Server Write IV[16]:
+| 68 8b 18 23 a1 1b 44 14 5f 4d 6b 97 01 04 b6 e2 |h..#..D._Mk.....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #443 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b...
+looking for RSA pre-master61049253a2d836006b56eb0fce73adc57dd6f0dc24475d45...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh|
+| 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.|
+| d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 50 c5 36 e6 fa 6b 21 55 2a 9c d9 4d f3 ae 7e |%P.6..k!U*..M..~|
+| 26 f1 9e 79 f3 a9 8d 35 44 2f 37 3b 6f 52 34 bf |&..y...5D/7;oR4.|
+| 25 d3 23 f9 f2 b3 94 e3 a7 ca 28 a0 8a 38 32 e4 |%.#.......(..82.|
+| b5 c1 cd ba 6b 86 7f 53 c5 69 65 67 00 |....k..S.ieg. |
+hash out[104]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....|
+| a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8|
+| 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......|
+| b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...|
+| 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x|
+| 09 1b c7 2c bd c8 dc 40 |...,...@ |
+PRF out[104]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....|
+| a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8|
+| 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......|
+| b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...|
+| 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x|
+| 09 1b c7 2c bd c8 dc 40 |...,...@ |
+key expansion[104]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....|
+| a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8|
+| 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......|
+| b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...|
+| 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x|
+| 09 1b c7 2c bd c8 dc 40 |...,...@ |
+Client MAC key[20]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 |.f.. |
+Server MAC key[20]:
+| f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f a0 ea 41 cc |....X-z.......A.|
+| aa c4 7a 33 |..z3 |
+Client Write key[16]:
+| d0 a5 84 15 60 02 50 38 85 d9 f3 4c 48 c1 21 84 |....`.P8...LH.!.|
+Server Write key[16]:
+| f4 6a a0 86 da 96 f2 ea b3 3f 39 01 15 6c 98 31 |.j.......?9..l.1|
+Client Write IV[16]:
+| 0f 9f 24 69 29 0f fe 92 81 53 31 ee 8f b3 c6 ec |..$i)....S1.....|
+Server Write IV[16]:
+| f9 2e c5 f2 5c a9 1e 78 09 1b c7 2c bd c8 dc 40 |....\..x...,...@|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh|
+| 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.|
+| d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 75 bf 62 a4 f8 a3 56 b2 46 e3 4f 33 64 24 6c 14 |u.b...V.F.O3d$l.|
+| 0a 6d 35 c1 bf a3 af a7 74 f3 b3 30 d6 44 86 c4 |.m5.....t..0.D..|
+| c9 21 93 e7 81 4d ee 21 14 d4 1a 9d 9a 73 ea cc |.!...M.!.....s..|
+| d4 eb d6 9b 5c 25 1e 70 14 41 c9 fe 41 56 8d cd |....\%.p.A..AV..|
+Plaintext[64]:
+| 06 2e 78 f0 0f 9d 30 40 95 7d cc a9 0a 24 ee ae |..x...0@.}...$..|
+| 14 00 00 0c fd bf 9a cb 14 b6 e4 fa 41 e7 ce 8e |............A...|
+| 75 af 2e 7d 2e 1e 64 13 d2 03 d8 74 42 17 76 33 |u..}..d....tB.v3|
+| 19 52 ae 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 75 af 2e 7d 2e 1e 64 13 d2 03 d8 74 42 17 76 33 |u..}..d....tB.v3|
+| 19 52 ae 9d |.R.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #444 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fe a7 fb fd 27 b4 e6 f9 fe 9f d0 10 00 ef b4 c9 |....'...........|
+| bf 56 37 a3 85 c9 3a 52 36 d8 d0 18 34 62 78 4b |.V7...:R6...4bxK|
+| f4 c1 8b 32 e0 c0 d0 c5 e9 0f 67 d6 d5 f0 95 87 |...2......g.....|
+| f3 43 29 31 aa 22 06 8c 33 a6 3f 9a 8e 78 c6 6b |.C)1."..3.?..x.k|
+Plaintext[64]:
+| 96 05 18 ca 7c 2a cc 08 9e e0 eb 25 34 bd d3 27 |....|*.....%4..'|
+| 14 00 00 0c 0c 5a 41 2b ca 34 b9 ed 46 c0 b2 59 |.....ZA+.4..F..Y|
+| 45 e8 72 39 3c 95 06 b1 2d 09 70 84 ad c6 4e 00 |E.r9<...-.p...N.|
+| 7a ec 1b bd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |z...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 45 e8 72 39 3c 95 06 b1 2d 09 70 84 ad c6 4e 00 |E.r9<...-.p...N.|
+| 7a ec 1b bd |z... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #445 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| eb ea bb c5 42 22 1b cc e7 8f 02 91 b7 9b aa 29 |....B".........)|
+| 72 26 8b b2 5d c7 ab 4d cb 58 3d 50 59 83 87 71 |r&..]..M.X=PY..q|
+| b9 f6 f6 61 85 b0 e7 10 c0 70 96 2d 8f 02 4c c4 |...a.....p.-..L.|
+| 38 a5 7e 09 91 2c e2 1d 35 5f b6 51 02 34 bf 0d |8.~..,..5_.Q.4..|
+| 19 d4 48 be 21 b2 ec 63 d2 45 13 62 f8 b0 2f 7e |..H.!..c.E.b../~|
+| 4e bc 75 1d 7b d5 5d 9c 90 2d 8c 1b 6b 74 d5 d7 |N.u.{.]..-..kt..|
+| a5 b5 d0 08 aa 8a 6c cd ce 61 65 b7 63 25 1a d4 |......l..ae.c%..|
+Plaintext[112]:
+| a8 f9 c1 d6 91 b9 6b be 1e 3b c3 72 7e 8d 03 d3 |......k..;.r~...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 31 0d 0a 0d 0a f7 ba 44 d4 94 |nl:4481......D..|
+| f7 4c 3d ce 63 a9 8b 65 06 78 34 5c 9a 32 71 00 |.L=.c..e.x4\.2q.|
+ssl_decrypt_record found padding 0 final len 111
+checking mac (len 75, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bd a5 61 5a 0a 32 d0 5d 92 e2 aa 5f 2a 84 f7 80 |..aZ.2.]..._*...|
+| 69 ba 6d bd |i.m. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35291 found (nil)
+association_find: TCP port 4481 found 0x3430c90
+
+dissect_ssl enter frame #446 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 51 29 df f3 28 35 9a 91 4e 9a b6 35 a4 86 b9 1f |Q)..(5..N..5....|
+| 31 74 b8 7e 01 31 87 37 bb 07 ec 56 34 a6 d9 c0 |1t.~.1.7...V4...|
+| ad b8 7e 05 f9 fb d5 93 30 de 14 a1 45 3a 1c db |..~.....0...E:..|
+| ce bd 04 be 98 32 c7 4f 3b 36 10 54 54 5a 8b 91 |.....2.O;6.TTZ..|
+| a3 f7 5e 68 1a bd 1e fb 27 f5 ad 59 14 99 8c b0 |..^h....'..Y....|
+| 60 0c 74 2e bc b6 63 02 c2 3e 9a 76 7f 69 c8 9c |`.t...c..>.v.i..|
+| 8c 08 e4 1e 98 6e bc 8d 8a fc fa f6 08 0c d2 93 |.....n..........|
+| 79 e6 62 e4 cb af 18 2f 75 25 b8 11 3e 31 ec ed |y.b..../u%..>1..|
+| 94 aa b8 d0 d4 78 6f 24 7b 5d 10 1b 9b 3c c2 da |.....xo${]...<..|
+| 58 31 f9 8c fb 56 a6 ea 7e 3c 6a 53 8d ff 0f b0 |X1...V..~<jS....|
+| 0b ce 7d 31 6b 77 45 2e ea a8 83 51 54 08 c9 72 |..}1kwE....QT..r|
+| af 6d b6 0a 92 12 e3 cb 77 13 f1 a9 56 99 39 2e |.m......w...V.9.|
+| 2b 2e c8 13 5f 28 b4 3b 5e 8d 00 49 32 a4 f3 99 |+..._(.;^..I2...|
+| cf 3a d0 98 cb c2 a7 1e 9a db a9 ba 0c 00 e8 fc |.:..............|
+| 04 28 e2 36 2a 61 99 31 41 74 3c e6 cc 1e ef 7c |.(.6*a.1At<....||
+| 2c 2f c0 1c d9 96 17 c1 86 69 17 33 41 64 33 2a |,/.......i.3Ad3*|
+| 39 b2 0b 72 ae a7 e4 e0 f4 e0 3f e6 55 fb 21 3c |9..r......?.U.!<|
+| f6 98 ed ba 1f 7b b6 a6 8c 6e 85 2f ad 44 1b 3a |.....{...n./.D.:|
+| 60 01 ec 1f 9b 40 47 3f 6e 70 7b 07 21 e6 f5 75 |`....@G?np{.!..u|
+| ad 3d 9e e1 bd ca f4 30 84 8a 75 86 9b 0f 93 55 |.=.....0..u....U|
+| ab ad 03 51 1e 9c ee 94 43 d8 58 34 a7 c3 ec 0d |...Q....C.X4....|
+| f0 da ea 6e eb ea 20 8d 67 ac d0 fb 16 ac 35 1a |...n.. .g.....5.|
+| 4b 10 96 77 b7 33 3e 2a 0a cd 13 0a 6b 5e 7c 40 |K..w.3>*....k^|@|
+| 1d 10 73 9e ff c1 7d 8f 2e 35 85 7e 93 5c ce 76 |..s...}..5.~.\.v|
+| 19 03 83 42 a7 88 d4 18 68 1d e0 42 dc be d1 b1 |...B....h..B....|
+Plaintext[400]:
+| bd 10 31 61 37 d4 69 67 18 e6 b7 96 37 2a 27 2a |..1a7.ig....7*'*|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 1b c7 |n.nl'</script>..|
+| e1 5d 38 8b c0 38 96 65 e2 af 6b 8c a3 fb 93 c9 |.]8..8.e..k.....|
+| b7 d7 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |................|
+ssl_decrypt_record found padding 13 final len 386
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 1a bb 57 65 99 ca b4 9e ef 5e 89 9f 2a fb 4b |...We.....^..*.K|
+| 26 8c 25 cf |&.%. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4481 found 0x3430c90
+
+dissect_ssl enter frame #447 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b4 f5 18 d0 43 34 fe c7 c7 3f 87 73 7d 64 92 bc |....C4...?.s}d..|
+| 29 a7 d0 ed fd c8 57 54 e2 99 35 74 67 14 f6 b8 |).....WT..5tg...|
+| a1 b0 c2 83 d6 73 9e ae a7 6c 43 41 78 7d aa c7 |.....s...lCAx}..|
+Plaintext[48]:
+| 79 19 51 7f 84 21 f3 17 eb b8 6f f2 fd ef 09 78 |y.Q..!....o....x|
+| 01 00 0e 5b 36 82 40 dc be 1a 15 e1 67 c3 8b 5d |...[6.@.....g..]|
+| c8 d9 49 dc 64 ed 09 09 09 09 09 09 09 09 09 09 |..I.d...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0e 5b 36 82 40 dc be 1a 15 e1 67 c3 8b 5d c8 d9 |.[6.@.....g..]..|
+| 49 dc 64 ed |I.d. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #449 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 91 73 4c b2 33 cb e3 ce c5 56 23 76 f1 56 64 a7 |.sL.3....V#v.Vd.|
+| be f6 34 62 8d 10 41 26 86 a8 61 b9 26 56 33 4d |..4b..A&..a.&V3M|
+| e9 a1 f3 6a d1 e2 30 5e e2 71 d0 02 10 29 e7 51 |...j..0^.q...).Q|
+Plaintext[48]:
+| 18 c7 bd 0c 40 79 14 42 fa b6 c2 2b 19 8f 95 75 |....@y.B...+...u|
+| 01 00 f8 6a 60 84 77 c4 38 3e 49 38 d0 5d 82 3e |...j`.w.8>I8.].>|
+| 68 ac f2 86 f9 c4 09 09 09 09 09 09 09 09 09 09 |h...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f8 6a 60 84 77 c4 38 3e 49 38 d0 5d 82 3e 68 ac |.j`.w.8>I8.].>h.|
+| f2 86 f9 c4 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #454 (first time)
+ssl_session_init: initializing ptr 0x7facc38557a0 size 688
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60875 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4482
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #456 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh|
+| 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.|
+| d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 80 8d ed eb bd 3b d0 5b 31 a2 1d 90 f8 a9 2a |%.....;.[1.....*|
+| 66 61 5f 19 52 fa e6 5b d0 65 fd 0a 9f 52 34 bf |fa_.R..[.e...R4.|
+| 25 dd 94 8c 65 1c 8c f3 3a 31 16 2b b4 23 86 31 |%...e...:1.+.#.1|
+| 08 c3 77 f8 e9 56 1e b5 3d c5 d5 35 c4 |..w..V..=..5. |
+hash out[136]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v|
+| 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.|
+| f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....|
+| 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..|
+| 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L|
+| c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..|
+| 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..|
+| 11 1e bb 07 67 2b c0 8b |....g+.. |
+PRF out[136]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v|
+| 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.|
+| f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....|
+| 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..|
+| 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L|
+| c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..|
+| 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..|
+| 11 1e bb 07 67 2b c0 8b |....g+.. |
+key expansion[136]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v|
+| 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.|
+| f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....|
+| 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..|
+| 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L|
+| c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..|
+| 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..|
+| 11 1e bb 07 67 2b c0 8b |....g+.. |
+Client MAC key[20]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b |,N.. |
+Server MAC key[20]:
+| 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 93 05 ad f7 |W...4.)....v....|
+| 14 85 14 12 |.... |
+Client Write key[32]:
+| 5a 11 f6 20 3f 6f 4a ce f9 78 07 82 ad f0 1e 12 |Z.. ?oJ..x......|
+| 7d 02 40 44 0e fd 16 b6 07 ae 76 68 8a 19 da 50 |}.@D......vh...P|
+Server Write key[32]:
+| 02 8f 8d 2c fb 6f 07 e8 5f 99 5e c1 8c 62 72 4f |...,.o.._.^..brO|
+| 83 cc 33 93 4b b9 89 4c c1 15 1e 38 4b aa 23 cd |..3.K..L...8K.#.|
+Client Write IV[16]:
+| 7e 18 d1 f6 d1 30 81 2e 41 6d f8 a9 4d 50 fd 05 |~....0..Am..MP..|
+Server Write IV[16]:
+| d4 70 40 54 21 2b be b6 11 1e bb 07 67 2b c0 8b |.p@T!+......g+..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #458 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9...
+looking for RSA pre-master61040104fe730d1a5fed30a8d6f3f23fa1cc83517c116595...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-|
+| aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.|
+| 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. |
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 80 8d ed eb bd 3b d0 5b 31 a2 1d 90 f8 a9 2a |%.....;.[1.....*|
+| 66 61 5f 19 52 fa e6 5b d0 65 fd 0a 9f 52 34 bf |fa_.R..[.e...R4.|
+| 25 dd 94 8c 65 1c 8c f3 3a 31 16 2b b4 23 86 31 |%...e...:1.+.#.1|
+| 08 c3 77 f8 e9 56 1e b5 3d c5 d5 35 c4 |..w..V..=..5. |
+hash out[136]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..|
+| b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...|
+| 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....n<f.......5|
+| f4 66 01 96 a8 7c b5 4b 89 51 c3 44 71 1d b7 f3 |.f...|.K.Q.Dq...|
+| 86 dd d8 ad 48 c8 d2 df 4e a1 77 91 36 55 63 1f |....H...N.w.6Uc.|
+| da 3c e4 d0 85 59 97 5d ef 8d b7 bf cf 2f 6d a2 |.<...Y.]...../m.|
+| 67 cf d0 e1 0b a9 26 ca 99 51 b4 6d fe ed 91 24 |g.....&..Q.m...$|
+| b3 13 c1 55 6b 1b 41 e3 |...Uk.A. |
+PRF out[136]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..|
+| b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...|
+| 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....n<f.......5|
+| f4 66 01 96 a8 7c b5 4b 89 51 c3 44 71 1d b7 f3 |.f...|.K.Q.Dq...|
+| 86 dd d8 ad 48 c8 d2 df 4e a1 77 91 36 55 63 1f |....H...N.w.6Uc.|
+| da 3c e4 d0 85 59 97 5d ef 8d b7 bf cf 2f 6d a2 |.<...Y.]...../m.|
+| 67 cf d0 e1 0b a9 26 ca 99 51 b4 6d fe ed 91 24 |g.....&..Q.m...$|
+| b3 13 c1 55 6b 1b 41 e3 |...Uk.A. |
+key expansion[136]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..|
+| b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...|
+| 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....n<f.......5|
+| f4 66 01 96 a8 7c b5 4b 89 51 c3 44 71 1d b7 f3 |.f...|.K.Q.Dq...|
+| 86 dd d8 ad 48 c8 d2 df 4e a1 77 91 36 55 63 1f |....H...N.w.6Uc.|
+| da 3c e4 d0 85 59 97 5d ef 8d b7 bf cf 2f 6d a2 |.<...Y.]...../m.|
+| 67 cf d0 e1 0b a9 26 ca 99 51 b4 6d fe ed 91 24 |g.....&..Q.m...$|
+| b3 13 c1 55 6b 1b 41 e3 |...Uk.A. |
+Client MAC key[20]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b |..U. |
+Server MAC key[20]:
+| 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 b6 22 25 d4 |.........,..."%.|
+| 60 8d e5 fc |`... |
+Client Write key[32]:
+| 97 38 49 5f 2f d1 9b 02 02 11 91 0c 14 6e 3c 66 |.8I_/........n<f|
+| cf aa a7 1d 85 d3 cf 35 f4 66 01 96 a8 7c b5 4b |.......5.f...|.K|
+Server Write key[32]:
+| 89 51 c3 44 71 1d b7 f3 86 dd d8 ad 48 c8 d2 df |.Q.Dq.......H...|
+| 4e a1 77 91 36 55 63 1f da 3c e4 d0 85 59 97 5d |N.w.6Uc..<...Y.]|
+Client Write IV[16]:
+| ef 8d b7 bf cf 2f 6d a2 67 cf d0 e1 0b a9 26 ca |...../m.g.....&.|
+Server Write IV[16]:
+| 99 51 b4 6d fe ed 91 24 b3 13 c1 55 6b 1b 41 e3 |.Q.m...$...Uk.A.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-|
+| aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.|
+| 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. |
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 08 2f be 9e 54 e4 0d 13 27 06 16 ca 33 74 19 66 |./..T...'...3t.f|
+| 08 3b 22 20 3f 07 03 45 f6 93 bb 67 61 37 cc 64 |.;" ?..E...ga7.d|
+| 94 ab cf f0 f1 14 2b 2e 3e 59 db 93 fb e6 4f 73 |......+.>Y....Os|
+| 15 0d b1 77 a1 23 4c 7e 1a b5 a1 6c 08 35 aa 7b |...w.#L~...l.5.{|
+Plaintext[64]:
+| 96 07 63 c8 08 b0 ca 4d 5f f3 8d 51 45 7a c4 80 |..c....M_..QEz..|
+| 14 00 00 0c 76 c0 c9 7f 9f 3e 1d ac 8b 12 f3 ad |....v....>......|
+| d8 52 55 fe 4e 30 ff d8 b9 ae 30 55 93 cb 01 6b |.RU.N0....0U...k|
+| 24 e3 eb f6 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |$...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d8 52 55 fe 4e 30 ff d8 b9 ae 30 55 93 cb 01 6b |.RU.N0....0U...k|
+| 24 e3 eb f6 |$... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #459 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 3b 02 8e 3c 38 7b 10 1e 56 20 c3 41 f7 53 ce 1a |;..<8{..V .A.S..|
+| 22 dd 49 2b 41 16 15 a6 dd 23 6b 19 ec f1 8a 97 |".I+A....#k.....|
+| 47 01 07 39 75 59 66 08 29 a5 a0 80 88 29 d1 a8 |G..9uYf.)....)..|
+| 14 9f b7 c5 8d c6 6d c4 c6 b3 06 e1 b5 c3 19 d7 |......m.........|
+Plaintext[64]:
+| db 1c 72 a8 c1 f7 b8 d5 b2 07 b7 62 c6 b6 67 f5 |..r........b..g.|
+| 14 00 00 0c 5b ef 6b 9d 33 f4 75 91 a0 45 9a 52 |....[.k.3.u..E.R|
+| ce 16 59 45 7a b3 77 78 07 69 b6 85 14 47 5d 48 |..YEz.wx.i...G]H|
+| 42 d2 ae 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |B...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ce 16 59 45 7a b3 77 78 07 69 b6 85 14 47 5d 48 |..YEz.wx.i...G]H|
+| 42 d2 ae 05 |B... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #460 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 6f ec f7 59 0d 5f 81 c6 b5 28 80 83 ba 82 4b ff |o..Y._...(....K.|
+| 3e 6a a8 24 23 3b b2 ee bd 37 a3 c5 69 42 22 f8 |>j.$#;...7..iB".|
+| c0 6d d5 cc 87 24 db fb 30 7a 00 89 55 c9 df 02 |.m...$..0z..U...|
+| 9f 56 52 08 e6 ed bd 42 71 86 2c da 00 f6 95 34 |.VR....Bq.,....4|
+| ec f7 3c f7 a4 f9 c5 26 f5 b6 ca 7d d4 dc f9 91 |..<....&...}....|
+| cf 3b 5a be 7c 4f dc 7b 3c 5a 30 90 87 22 4d d9 |.;Z.|O.{<Z0.."M.|
+| eb 8f 4f 51 bd 53 5a ce 0c ec cf 49 02 0e 31 5f |..OQ.SZ....I..1_|
+Plaintext[112]:
+| a8 e3 f7 a2 9d f2 51 46 12 e6 dd a4 ba cd 10 9b |......QF........|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 32 0d 0a 0d 0a eb b1 2e 4e 65 |nl:4482.......Ne|
+| ae f0 b9 44 30 7d 6a 6a 54 75 53 c9 bf b5 0f 00 |...D0}jjTuS.....|
+ssl_decrypt_record found padding 0 final len 111
+checking mac (len 75, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c5 99 98 b0 46 d1 27 b1 14 85 b5 28 59 da 6f 1c |....F.'....(Y.o.|
+| 60 1b 1a 8c |`... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60875 found (nil)
+association_find: TCP port 4482 found 0x3430d20
+
+dissect_ssl enter frame #461 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e9 7a c3 1d c1 aa 83 9a 22 4f ac ab 49 15 01 73 |.z......"O..I..s|
+| c5 90 cb 2c f7 bd 39 7d d7 29 1e b1 9e 7c c8 95 |...,..9}.)...|..|
+| ab 51 ec c1 0e b7 15 17 33 0c f8 d0 d1 84 d5 53 |.Q......3......S|
+| b6 5e 88 b8 07 4f 79 70 2c 07 3e 0a dc 3c c4 32 |.^...Oyp,.>..<.2|
+| a9 00 f6 b9 e2 86 cf 0d 42 39 7f fa 16 9a 3a 38 |........B9....:8|
+| 43 6e 3d 39 9c f9 88 c5 dd f1 b6 a7 56 6a 17 54 |Cn=9........Vj.T|
+| 50 ea c5 9b c8 79 7c 80 14 4e 46 21 6d 32 ad 84 |P....y|..NF!m2..|
+| 1a 5a 80 0f 9b d6 f7 90 a1 ff 93 1e 5a d5 1c 10 |.Z..........Z...|
+| 69 35 0a 23 67 8e d9 30 fb 86 3b b4 0a 71 f1 09 |i5.#g..0..;..q..|
+| 31 70 54 0f 28 bc 3d b3 29 bc ce 5a 4e 25 5f e9 |1pT.(.=.)..ZN%_.|
+| 02 e3 e2 fc 6f 3f 7e 55 3d 51 51 4e 18 7d 0f d5 |....o?~U=QQN.}..|
+| 43 51 e4 b8 be 97 9d be 9e dd 54 4e e6 d6 ad ab |CQ........TN....|
+| 82 96 5c a7 ca 9d 58 8a 75 e9 2d 34 87 73 93 f9 |..\...X.u.-4.s..|
+| 4d 5e f5 87 3b 8d 4a 77 92 7f 8a 91 38 63 e1 df |M^..;.Jw....8c..|
+| e2 dc 58 c9 55 47 5b 18 1f 5d 0a 71 f9 7d 63 2c |..X.UG[..].q.}c,|
+| ea 98 44 b3 fc a0 3a 8b 5e 3b 0e e3 7e 1c d4 7b |..D...:.^;..~..{|
+| a0 0f 3b 33 80 65 c1 f6 47 e1 64 fc 03 dd 3c 3f |..;3.e..G.d...<?|
+| 69 c9 e0 ca de 57 fd 30 93 30 4b 8b 13 5d 00 29 |i....W.0.0K..].)|
+| 61 91 3c 1b f2 1a 2c 9a 63 a0 44 65 79 35 0d 79 |a.<...,.c.Dey5.y|
+| a2 48 1a 4b b2 58 ab 9a d0 d2 16 be 0a 26 cd 54 |.H.K.X.......&.T|
+| 2a d7 c4 85 2a 22 7b 8f 00 85 2a d5 d0 0b 57 65 |*...*"{...*...We|
+| 09 cd 6c c7 03 61 e9 ce 08 73 f4 55 29 f1 1a 8a |..l..a...s.U)...|
+| d6 b4 e6 a8 62 bc d3 07 d5 fd 9c ed ac 4f 59 6e |....b........OYn|
+| e3 6e f8 1d 65 7a 65 8f 7b 68 ec 47 fb 29 40 7b |.n..eze.{h.G.)@{|
+| 40 7c f0 78 49 88 80 3a 79 6e 98 ba 26 4f 82 ab |@|.xI..:yn..&O..|
+Plaintext[400]:
+| 42 54 c9 4f 7e b5 16 c9 33 4d 14 3c 9f 71 6b 6d |BT.O~...3M.<.qkm|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e c7 50 |n.nl'</script>.P|
+| 4f 0f 5d 32 96 72 59 0c 4a 96 c0 71 3e 0f a7 d5 |O.]2.rY.J..q>...|
+| 43 de 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |C...............|
+ssl_decrypt_record found padding 13 final len 386
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 03 16 0b 97 e0 f2 a8 38 51 1d f8 c8 2c 3c bf 6a |.......8Q...,<.j|
+| 8c 98 39 82 |..9. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4482 found 0x3430d20
+
+dissect_ssl enter frame #462 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 26 4b 3b 3b 40 da a9 bd a1 cc 9f fd 77 f8 65 9f |&K;;@.......w.e.|
+| 04 0e bf fe de 3c de 88 64 dc 1e 4f 73 b8 ca 21 |.....<..d..Os..!|
+| 03 62 21 37 1e f3 57 bb 05 e3 96 b5 c8 48 7a b3 |.b!7..W......Hz.|
+Plaintext[48]:
+| 9c bc 84 c1 65 72 ae 5c 32 75 23 89 82 51 c2 e8 |....er.\2u#..Q..|
+| 01 00 81 64 71 ae b5 b2 b9 41 08 0a 64 e3 1c 35 |...dq....A..d..5|
+| cb 76 01 3f b4 7b 09 09 09 09 09 09 09 09 09 09 |.v.?.{..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 81 64 71 ae b5 b2 b9 41 08 0a 64 e3 1c 35 cb 76 |.dq....A..d..5.v|
+| 01 3f b4 7b |.?.{ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #464 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 6a d1 a6 c4 76 79 0a 8d a3 9f af 8e a1 19 03 fb |j...vy..........|
+| 7c 8c ea aa ec e5 0e 34 7d 50 05 be 3d 25 c9 cc ||......4}P..=%..|
+| ba 01 0d 55 c8 8c 27 63 a5 e3 62 8d b5 51 87 94 |...U..'c..b..Q..|
+Plaintext[48]:
+| 92 71 31 33 22 30 f4 d8 1b c0 37 46 c9 89 53 ef |.q13"0....7F..S.|
+| 01 00 dd 34 a5 a3 bd 69 e8 61 84 cb 09 20 b2 68 |...4...i.a... .h|
+| 6d 95 ba 01 56 05 09 09 09 09 09 09 09 09 09 09 |m...V...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| dd 34 a5 a3 bd 69 e8 61 84 cb 09 20 b2 68 6d 95 |.4...i.a... .hm.|
+| ba 01 56 05 |..V. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #469 (first time)
+ssl_session_init: initializing ptr 0x7facc3857c80 size 688
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 42810 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4483
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #471 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 751
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-|
+| aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.|
+| 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. |
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 be cb 55 c6 ba dc 80 91 52 b9 ad 79 ee 35 c3 |%..U.....R..y.5.|
+| c4 b2 ff 61 cb c0 9a 02 5d 1b 12 45 53 52 34 bf |...a....]..ESR4.|
+| 25 36 41 17 b6 4e 6c d3 32 95 37 71 73 08 7b 12 |%6A..Nl.2.7qs.{.|
+| dc f7 b8 17 99 d0 88 12 3c bc c2 77 46 |........<..wF |
+hash out[72]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..|
+| 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".<r..C..FN#.I|
+| 52 53 83 5e ed e4 4b c9 57 e7 d6 5a 32 b9 23 61 |RS.^..K.W..Z2.#a|
+| 86 21 85 61 c9 57 6c bf |.!.a.Wl. |
+PRF out[72]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..|
+| 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".<r..C..FN#.I|
+| 52 53 83 5e ed e4 4b c9 57 e7 d6 5a 32 b9 23 61 |RS.^..K.W..Z2.#a|
+| 86 21 85 61 c9 57 6c bf |.!.a.Wl. |
+key expansion[72]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..|
+| 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".<r..C..FN#.I|
+| 52 53 83 5e ed e4 4b c9 57 e7 d6 5a 32 b9 23 61 |RS.^..K.W..Z2.#a|
+| 86 21 85 61 c9 57 6c bf |.!.a.Wl. |
+Client MAC key[20]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 |.p.. |
+Server MAC key[20]:
+| 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c 51 2b 22 a4 |...|3....`..Q+".|
+| 3c 72 eb fa |<r.. |
+Client Write key[16]:
+| 43 ec cd 46 4e 23 94 49 52 53 83 5e ed e4 4b c9 |C..FN#.IRS.^..K.|
+Server Write key[16]:
+| 57 e7 d6 5a 32 b9 23 61 86 21 85 61 c9 57 6c bf |W..Z2.#a.!.a.Wl.|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 680
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 195
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 181, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 177 bytes, remaining 742
+ record: offset = 742, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 747 length 0 bytes, remaining 751
+
+dissect_ssl enter frame #473 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799...
+looking for RSA pre-master4104a377ae79f26777c1ba7ff8da9b95ddd0b7306727cf0e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...|
+| 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...|
+| 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 be cb 55 c6 ba dc 80 91 52 b9 ad 79 ee 35 c3 |%..U.....R..y.5.|
+| c4 b2 ff 61 cb c0 9a 02 5d 1b 12 45 53 52 34 bf |...a....]..ESR4.|
+| 25 36 41 17 b6 4e 6c d3 32 95 37 71 73 08 7b 12 |%6A..Nl.2.7qs.{.|
+| dc f7 b8 17 99 d0 88 12 3c bc c2 77 46 |........<..wF |
+hash out[72]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 |..J.a.Mr|e...T0.|
+| c6 62 1f 08 e0 a3 dd 93 25 47 47 00 82 d4 82 e1 |.b......%GG.....|
+| 4d 86 60 77 ee 4b d0 cf 95 64 bf 27 3c 56 80 4d |M.`w.K...d.'<V.M|
+| 86 07 f3 18 da 2b 42 85 |.....+B. |
+PRF out[72]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 |..J.a.Mr|e...T0.|
+| c6 62 1f 08 e0 a3 dd 93 25 47 47 00 82 d4 82 e1 |.b......%GG.....|
+| 4d 86 60 77 ee 4b d0 cf 95 64 bf 27 3c 56 80 4d |M.`w.K...d.'<V.M|
+| 86 07 f3 18 da 2b 42 85 |.....+B. |
+key expansion[72]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 |..J.a.Mr|e...T0.|
+| c6 62 1f 08 e0 a3 dd 93 25 47 47 00 82 d4 82 e1 |.b......%GG.....|
+| 4d 86 60 77 ee 4b d0 cf 95 64 bf 27 3c 56 80 4d |M.`w.K...d.'<V.M|
+| 86 07 f3 18 da 2b 42 85 |.....+B. |
+Client MAC key[20]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca |..J. |
+Server MAC key[20]:
+| 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 c6 62 1f 08 |a.Mr|e...T0..b..|
+| e0 a3 dd 93 |.... |
+Client Write key[16]:
+| 25 47 47 00 82 d4 82 e1 4d 86 60 77 ee 4b d0 cf |%GG.....M.`w.K..|
+Server Write key[16]:
+| 95 64 bf 27 3c 56 80 4d 86 07 f3 18 da 2b 42 85 |.d.'<V.M.....+B.|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 80 be 73 03 00 00 00 00 |..s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...|
+| 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...|
+| 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| ce aa 82 b5 53 3b 88 d8 d7 16 e9 50 71 a6 fa 33 |....S;.....Pq..3|
+| 05 06 6b df 6f 21 11 0f aa d6 ed 3e 68 e7 9e f8 |..k.o!.....>h...|
+| d1 a0 74 82 |..t. |
+Plaintext[36]:
+| 14 00 00 0c ee 62 f1 67 47 d3 1d da cf 2c 7d 1c |.....b.gG....,}.|
+| 3f c2 a4 ec 7a 1b b5 16 3e 0c 6f ca 18 cc 60 cd |?...z...>.o...`.|
+| 11 fa 61 d8 |..a. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3f c2 a4 ec 7a 1b b5 16 3e 0c 6f ca 18 cc 60 cd |?...z...>.o...`.|
+| 11 fa 61 d8 |..a. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #474 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| ba 97 7a 31 c8 e9 66 87 80 47 3a ab 1b 9f 70 89 |..z1..f..G:...p.|
+| 31 e8 64 10 0d d4 e8 4d 82 87 45 16 58 c0 b0 9c |1.d....M..E.X...|
+| 4a 3e 52 fa |J>R. |
+Plaintext[36]:
+| 14 00 00 0c e0 e7 60 19 fa 1f 79 0c c8 60 ab 81 |......`...y..`..|
+| 07 48 84 a6 eb c8 f8 4a 57 e1 16 c8 27 f0 88 fa |.H.....JW...'...|
+| b5 3f 9b 01 |.?.. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 07 48 84 a6 eb c8 f8 4a 57 e1 16 c8 27 f0 88 fa |.H.....JW...'...|
+| b5 3f 9b 01 |.?.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #475 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 98
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 93, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 93
+Ciphertext[93]:
+| d4 c9 e6 1e 68 aa a0 94 f4 bc 84 fd a7 95 7b 3b |....h.........{;|
+| 02 b1 7a bf 65 57 a5 31 d1 e1 e9 6c 37 da 0a c4 |..z.eW.1...l7...|
+| 08 c0 3a dd c1 d3 67 07 d5 8c 1b dd d7 06 d3 43 |..:...g........C|
+| ef 53 04 36 cc c1 1a 3b 28 a3 2a 3c 77 cd 48 d8 |.S.6...;(.*<w.H.|
+| 1d 5b fa 89 04 f8 f3 19 d8 d4 a6 b9 37 a5 72 da |.[..........7.r.|
+| bc 33 70 6a bc 93 b6 82 07 68 aa 25 d0 |.3pj.....h.%. |
+Plaintext[93]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a fb 6e 69 02 61 70 fb |:4483.....ni.ap.|
+| 45 f6 26 51 37 bc 92 db e4 a3 e4 a5 67 |E.&Q7.......g |
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fb 6e 69 02 61 70 fb 45 f6 26 51 37 bc 92 db e4 |.ni.ap.E.&Q7....|
+| a3 e4 a5 67 |...g |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73
+association_find: TCP port 42810 found (nil)
+association_find: TCP port 4483 found 0x3430db0
+dissect_ssl3_record decrypted len 73
+decrypted app data fragment[73]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a |:4483.... |
+dissect_ssl3_record found association 0x3430db0
+
+dissect_ssl enter frame #476 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 374
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 369, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 369
+Ciphertext[369]:
+| 94 cc 95 cd a2 0b cc cd d9 44 c8 e8 b5 9d 3a 14 |.........D....:.|
+| 40 7c f6 79 7f 21 e8 4a 5b 81 73 01 8e 9a 84 7c |@|.y.!.J[.s....||
+| c9 19 24 86 f0 7e 4c 44 95 23 8f 2b ca c7 80 bf |..$..~LD.#.+....|
+| 97 b6 c5 fb 35 bd e0 71 e9 1d 8a a1 7c 2a 7d f2 |....5..q....|*}.|
+| 03 b9 41 aa b7 30 9d 62 db b7 ae eb 32 8c 20 35 |..A..0.b....2. 5|
+| 90 8d 84 4c 58 80 a3 76 80 18 f6 4d 6c 54 a7 d6 |...LX..v...MlT..|
+| 3c bd b7 f9 3b ee 19 4f 89 9d d9 90 d8 4c 61 40 |<...;..O.....La@|
+| a7 fb 74 01 df ff ec cd 4d 05 e1 5b 21 b4 73 b7 |..t.....M..[!.s.|
+| d0 7f 13 5a d2 73 27 03 c3 e5 34 bc 61 b8 e7 7c |...Z.s'...4.a..||
+| 16 61 a6 7f aa 82 2a bd fa 2d 0d 03 f4 33 33 70 |.a....*..-...33p|
+| 16 0d 60 96 1c b3 37 4f d3 f9 01 57 d5 a8 d1 a4 |..`...7O...W....|
+| e0 fd 8b 81 d9 57 49 c6 b0 73 e1 27 03 9b ef e9 |.....WI..s.'....|
+| d0 97 b9 07 79 1f e8 d3 b6 c7 7c 7b fa ad cc 87 |....y.....|{....|
+| 27 69 88 98 c0 35 6e c7 e3 e3 21 13 29 ee 63 3d |'i...5n...!.).c=|
+| f6 3a 42 ac c6 d7 04 82 4b 48 5b 0a f7 09 c5 19 |.:B.....KH[.....|
+| 17 5d 2b 0f b0 4d 2b 4f 6f fc 3b 43 44 89 76 02 |.]+..M+Oo.;CD.v.|
+| fe 34 d1 24 90 52 9f 7b 68 02 64 60 88 f6 e5 8d |.4.$.R.{h.d`....|
+| 5d ce 72 15 ab 7b b6 0a 26 5a 5a b9 94 cc 09 3d |].r..{..&ZZ....=|
+| fe 43 e7 bc d9 67 e9 80 d3 2b 89 65 fd db b4 b2 |.C...g...+.e....|
+| 12 ff fa ee 65 5a 0b 3a c4 27 55 28 1e 6a e1 cc |....eZ.:.'U(.j..|
+| 66 44 03 1f 4c 50 f7 ee 9c f3 7f 48 1e 09 c4 55 |fD..LP.....H...U|
+| 78 e8 0e 47 ed d2 8e 7f 1c f0 ea 7b 0a d1 02 0b |x..G.......{....|
+| f2 05 fa 0c 4d 5b 47 f8 f0 6c e1 01 4a 22 02 af |....M[G..l..J"..|
+| 14 |. |
+Plaintext[369]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 7d 92 d3 |.nl'</script>}..|
+| 03 69 9e 5b 68 86 cf e6 eb bd 43 f0 59 7d 08 33 |.i.[h.....C.Y}.3|
+| 3b |; |
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7d 92 d3 03 69 9e 5b 68 86 cf e6 eb bd 43 f0 59 |}...i.[h.....C.Y|
+| 7d 08 33 3b |}.3; |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349
+association_find: TCP port 4483 found 0x3430db0
+dissect_ssl3_record decrypted len 349
+decrypted app data fragment[349]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |.nl'</script> |
+dissect_ssl3_record found association 0x3430db0
+
+dissect_ssl enter frame #477 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 91 eb 41 55 a6 69 2b b3 b8 d0 ab 4f b5 37 f4 cf |..AU.i+....O.7..|
+| 67 c0 18 15 f2 d7 |g..... |
+Plaintext[22]:
+| 01 00 b3 72 3d 19 41 db 4e 37 4b 91 75 e7 a7 d9 |...r=.A.N7K.u...|
+| 56 c8 92 fc 14 eb |V..... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 72 3d 19 41 db 4e 37 4b 91 75 e7 a7 d9 56 c8 |.r=.A.N7K.u...V.|
+| 92 fc 14 eb |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #479 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 17 04 df 10 8e cf b7 65 de 05 75 56 3a 9f 8c 4d |.......e..uV:..M|
+| b4 31 49 a5 bf 33 |.1I..3 |
+Plaintext[22]:
+| 01 00 75 37 2b d5 78 bc f0 9d f8 f5 2c 27 01 e3 |..u7+.x.....,'..|
+| 90 4c 2d ce d1 3c |.L-..< |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 75 37 2b d5 78 bc f0 9d f8 f5 2c 27 01 e3 90 4c |u7+.x.....,'...L|
+| 2d ce d1 3c |-..< |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #484 (first time)
+ssl_session_init: initializing ptr 0x7facc385a590 size 688
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 36532 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4484
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #486 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 749
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...|
+| 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...|
+| 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 63 75 18 a1 69 ea 50 83 57 47 1e b7 43 54 10 |&cu..i.P.WG..CT.|
+| 58 0c ac 52 59 b1 d9 6a 75 21 53 a1 90 52 34 bf |X..RY..ju!S..R4.|
+| 26 4e 71 d4 63 88 17 c3 e3 1b ea ef 04 7e fe 0b |&Nq.c........~..|
+| 65 a6 4c 7c f5 a8 7a b0 39 b4 09 0e 7a |e.L|..z.9...z |
+hash out[104]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......|
+| e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......|
+| 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!|
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..|
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+PRF out[104]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......|
+| e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......|
+| 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!|
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..|
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+key expansion[104]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......|
+| e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......|
+| 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!|
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..|
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+Client MAC key[20]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 |!*R6 |
+Server MAC key[20]:
+| 27 51 df fd 26 07 ed 9a e8 84 a5 e3 e7 93 f5 c1 |'Q..&...........|
+| a8 e6 6d bd |..m. |
+Client Write key[24]:
+| 41 ff f5 14 86 0c 83 e0 4f 0c 8f 83 c7 ac ad d2 |A.......O.......|
+| a7 3a bb 09 da 06 16 21 |.:.....! |
+Server Write key[24]:
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 |......9R |
+Client Write IV[8]:
+| ce a2 aa 3c ec 47 fa de |...<.G.. |
+Server Write IV[8]:
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 678
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 193
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 179, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 175 bytes, remaining 740
+ record: offset = 740, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 745 length 0 bytes, remaining 749
+
+dissect_ssl enter frame #488 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5...
+looking for RSA pre-master41048d81014331c4904f5fb9f90ff4fb8410ee7d7640b337...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.|
+| 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..|
+| db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 63 75 18 a1 69 ea 50 83 57 47 1e b7 43 54 10 |&cu..i.P.WG..CT.|
+| 58 0c ac 52 59 b1 d9 6a 75 21 53 a1 90 52 34 bf |X..RY..ju!S..R4.|
+| 26 4e 71 d4 63 88 17 c3 e3 1b ea ef 04 7e fe 0b |&Nq.c........~..|
+| 65 a6 4c 7c f5 a8 7a b0 39 b4 09 0e 7a |e.L|..z.9...z |
+hash out[104]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c|
+| 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.|
+| ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.|
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........|
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+PRF out[104]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c|
+| 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.|
+| ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.|
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........|
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+key expansion[104]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c|
+| 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.|
+| ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.|
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........|
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+Client MAC key[20]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 |.I'B |
+Server MAC key[20]:
+| d9 c4 d7 39 99 61 e5 fe af 74 2e 63 6d 28 dc c8 |...9.a...t.cm(..|
+| c6 e7 2f a0 |../. |
+Client Write key[24]:
+| 66 54 12 d7 09 08 36 b8 ba b7 e8 7b b3 88 e5 8b |fT....6....{....|
+| 8d e3 4c 2c bf 71 5c 88 |..L,.q\. |
+Server Write key[24]:
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 |...D.[.. |
+Client Write IV[8]:
+| 11 da ea a9 d6 e1 bb 0e |........ |
+Server Write IV[8]:
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.|
+| 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..|
+| db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3d 5c 24 34 49 df 11 1f 88 f8 10 8d 0c 45 a5 85 |=\$4I........E..|
+| 81 b9 4c 0c d0 92 93 8b 48 7e 99 79 6b 97 85 e5 |..L.....H~.yk...|
+| e7 06 29 f4 93 43 18 cc a8 17 f6 ba 81 74 b4 e1 |..)..C.......t..|
+Plaintext[48]:
+| 6d f5 51 62 95 30 1e 66 14 00 00 0c bb 70 ed f7 |m.Qb.0.f.....p..|
+| 9c 48 f1 8c bc be 44 cd 25 95 cf e3 9d 53 c3 f1 |.H....D.%....S..|
+| b7 64 e1 da 31 60 a0 9e f7 12 5f 15 03 03 03 03 |.d..1`...._.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 95 cf e3 9d 53 c3 f1 b7 64 e1 da 31 60 a0 9e |%....S...d..1`..|
+| f7 12 5f 15 |.._. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #489 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 43 75 06 06 0c e5 61 8f e4 8a 5f 4e 2d a3 7d 00 |Cu....a..._N-.}.|
+| 6b 91 2e ee 8a ff 12 b4 97 99 26 f4 4d d1 f2 9d |k.........&.M...|
+| 66 82 b7 b6 9d a3 8e b8 11 ca c9 59 07 04 df 6e |f..........Y...n|
+Plaintext[48]:
+| ff de 57 1b 17 2e 9e 0f 14 00 00 0c 99 9d 64 0a |..W...........d.|
+| 48 ce 30 75 fb 26 7e d7 52 ce 51 aa bf 46 80 eb |H.0u.&~.R.Q..F..|
+| df 86 20 e0 ba b4 dd 5b 8f 48 c2 e8 03 03 03 03 |.. ....[.H......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 52 ce 51 aa bf 46 80 eb df 86 20 e0 ba b4 dd 5b |R.Q..F.... ....[|
+| 8f 48 c2 e8 |.H.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #490 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 1b 72 0f a2 1b 36 0a 91 7b e8 d7 a1 da c8 e7 ad |.r...6..{.......|
+| 23 c4 12 6f a6 4b 79 97 7c 4a ab 09 fe 7f 20 3d |#..o.Ky.|J.... =|
+| 98 af 7d 9d f6 43 b0 54 73 66 90 e2 51 7a 88 19 |..}..C.Tsf..Qz..|
+| a2 77 8f 09 a8 f2 47 97 cc 6a 42 cc d2 62 ae cf |.w....G..jB..b..|
+| 1e 64 d7 98 42 1f 19 25 91 90 b3 0d 36 06 2e 95 |.d..B..%....6...|
+| a5 8a 15 91 ff 21 2b b0 dd 96 68 d5 f0 ad 7b b1 |.....!+...h...{.|
+| f1 24 a2 59 ac a2 51 e4 8c 0f 34 ab 06 9f 23 9b |.$.Y..Q...4...#.|
+Plaintext[112]:
+| 59 6e f5 de 2b 6a 5e 58 47 45 54 20 2f 20 48 54 |Yn..+j^XGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 65 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 |dhe-ecdsa-des-cb|
+| 63 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |c3-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 38 34 0d 0a 0d 0a b7 ce 64 82 ec 01 38 20 f5 c5 |84......d...8 ..|
+| d0 ac 05 85 fb 66 c6 01 69 05 05 05 05 05 05 05 |.....f..i.......|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 78, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1d 9c 0c af ee b0 17 71 c8 d9 42 c5 de d8 da 9c |.......q..B.....|
+| ba 10 6d 30 |..m0 |
+ssl_decrypt_record: mac failed
+association_find: TCP port 36532 found (nil)
+association_find: TCP port 4484 found 0x3430e40
+
+dissect_ssl enter frame #491 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 6d 94 19 90 42 6f 88 28 fa 85 6d 21 d1 f3 86 8a |m...Bo.(..m!....|
+| d6 fd e9 1a c8 e0 dc d0 df 46 06 27 49 cf 54 aa |.........F.'I.T.|
+| 2d 17 6e 00 db 2a 4f b4 74 9e fb 95 9b 26 34 f9 |-.n..*O.t....&4.|
+| 06 8d f6 0f 3f 5a bd 56 06 65 32 2b 64 89 6c fa |....?Z.V.e2+d.l.|
+| de e9 fa 35 e7 46 b7 f5 aa cd c9 b5 0a c5 40 c1 |...5.F........@.|
+| 16 33 47 90 c7 cd 37 e6 68 ca 6d 4f cc 1f 18 d0 |.3G...7.h.mO....|
+| 8b 33 48 a0 22 b4 92 3d 2e 83 d7 0b 25 e0 f3 28 |.3H."..=....%..(|
+| d8 33 b4 0c 9a 9f f6 42 23 73 5c 24 c1 54 d0 29 |.3.....B#s\$.T.)|
+| 83 26 4e 77 80 11 e6 b2 4a 05 32 08 68 4e 8a f8 |.&Nw....J.2.hN..|
+| ce 4d 89 1e 2e 91 84 2c cf f1 3e ae 4e 54 55 68 |.M.....,..>.NTUh|
+| 1b f0 2e c9 52 38 79 49 09 b6 6e 28 aa 69 29 05 |....R8yI..n(.i).|
+| 76 79 f1 99 72 d0 68 cf 07 0b 44 b5 62 fc ea 2f |vy..r.h...D.b../|
+| cc 2d 63 6d 5e 40 a9 de b4 40 bd 5a 21 7f 72 9a |.-cm^@...@.Z!.r.|
+| dc f3 a1 59 1f b5 49 f5 57 ce 59 ba 21 58 3c 35 |...Y..I.W.Y.!X<5|
+| a0 b8 85 c1 70 a5 29 8b dc 7e 4d 75 7a b9 21 67 |....p.)..~Muz.!g|
+| 86 0f 14 9c 48 62 3f 4f 53 91 8e 06 fa 92 b0 22 |....Hb?OS......"|
+| fd b1 37 2e 41 9d 0e 82 d3 a8 c3 46 7d 8c 46 40 |..7.A......F}.F@|
+| f7 cd a5 eb f4 02 c4 58 1c 73 12 e7 eb 76 bd 18 |.......X.s...v..|
+| 2c 8a 23 36 47 38 94 fd 43 88 3a 9c ca 46 28 bc |,.#6G8..C.:..F(.|
+| c5 11 38 dd e1 ae 73 15 a3 42 74 55 6e 27 0c aa |..8...s..BtUn'..|
+| 2d 51 4c 8d c9 f6 21 b5 42 71 a4 9a 8c 02 45 5d |-QL...!.Bq....E]|
+| 60 24 27 7c 73 c9 91 30 21 c2 db 28 db cc a3 2d |`$'|s..0!..(...-|
+| 1a b0 f1 8e 73 dd 20 fe cd 7e ea 3f 10 d2 f0 b7 |....s. ..~.?....|
+| 3b 72 3b 36 a1 25 be d7 2d bc 44 20 ca b9 0b d0 |;r;6.%..-.D ....|
+Plaintext[384]:
+| 6d f2 a3 0b 4f c4 20 03 48 54 54 50 2f 31 2e 31 |m...O. .HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 38 20 47 4d |2013 19:55:18 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 38 |che....0xC0,0x08|
+| 20 2d 20 45 43 44 48 45 2d 45 43 44 53 41 2d 44 | - ECDHE-ECDSA-D|
+| 45 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 |ES-CBC3-SHA SSLv|
+| 33 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 |3 Kx=ECDH Au|
+| 3d 45 43 44 53 41 20 45 6e 63 3d 33 44 45 53 28 |=ECDSA Enc=3DES(|
+| 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1<sc|
+| 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f |ript>document.do|
+| 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'</s|
+| 63 72 69 70 74 3e a8 df 1f d0 a1 a2 9a 50 74 23 |cript>.......Pt#|
+| 81 e8 8e fb af 96 08 a4 5f 21 05 05 05 05 05 05 |........_!......|
+ssl_decrypt_record found padding 5 final len 378
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4d c3 3e 6b cd b7 cd 8c 19 ad f8 6a f1 a8 cf d2 |M.>k.......j....|
+| 48 4f 77 04 |HOw. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4484 found 0x3430e40
+
+dissect_ssl enter frame #492 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 3e b9 b5 3b 53 b8 6f 54 a7 a1 36 2f 24 01 77 5d |>..;S.oT..6/$.w]|
+| 5b f0 43 e4 8b 64 cf 85 82 41 27 f9 b0 12 64 0c |[.C..d...A'...d.|
+Plaintext[32]:
+| 7c e1 7e ef 91 21 98 ed 01 00 fd 03 a8 5e 8e 9c ||.~..!.......^..|
+| 1d f3 0f b0 18 94 c3 db d5 07 29 fc dc 09 01 01 |..........).....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fd 03 a8 5e 8e 9c 1d f3 0f b0 18 94 c3 db d5 07 |...^............|
+| 29 fc dc 09 |)... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #494 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| c4 53 be c4 c4 03 1e 8c d4 fa 9a fa 70 f1 25 85 |.S..........p.%.|
+| 64 be b1 7e b1 c8 0d 02 8f 24 b2 9f 6f 6e 4f f1 |d..~.....$..onO.|
+Plaintext[32]:
+| 29 86 58 2a f2 ef 5d a1 01 00 27 c7 2b d9 6e ff |).X*..]...'.+.n.|
+| 81 21 3f f5 a6 6b 6f 13 45 f6 10 5e cd 36 01 01 |.!?..ko.E..^.6..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 27 c7 2b d9 6e ff 81 21 3f f5 a6 6b 6f 13 45 f6 |'.+.n..!?..ko.E.|
+| 10 5e cd 36 |.^.6 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #499 (first time)
+ssl_session_init: initializing ptr 0x7facc385ca50 size 688
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 39630 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4485
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #501 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 750
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.|
+| 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..|
+| db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 71 56 d7 fa 01 ff 15 62 7d 9b 9a ce 03 51 1c |&qV.....b}....Q.|
+| a7 df de 84 61 af f9 71 20 c4 fd d3 87 52 34 bf |....a..q ....R4.|
+| 26 77 b4 93 f8 e1 66 8f 05 35 c7 c5 61 25 77 1b |&w....f..5..a%w.|
+| 4a 55 b7 33 38 ea 0f f7 72 1a 67 e2 98 |JU.38...r.g.. |
+hash out[104]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........|
+| 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.|
+| 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..|
+| 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...|
+| 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...|
+| 26 c7 57 9e 42 9d 83 ef |&.W.B... |
+PRF out[104]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........|
+| 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.|
+| 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..|
+| 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...|
+| 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...|
+| 26 c7 57 9e 42 9d 83 ef |&.W.B... |
+key expansion[104]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........|
+| 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.|
+| 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..|
+| 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...|
+| 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...|
+| 26 c7 57 9e 42 9d 83 ef |&.W.B... |
+Client MAC key[20]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 |p... |
+Server MAC key[20]:
+| 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 3b 3e 90 da |_{..........;>..|
+| a0 28 68 bb |.(h. |
+Client Write key[16]:
+| 68 d0 95 37 99 0f 50 ed 75 c1 f5 07 50 4b fa 1b |h..7..P.u...PK..|
+Server Write key[16]:
+| e0 3b 62 1a 65 5b 9a e0 91 47 fd b6 2b c7 ab f4 |.;b.e[...G..+...|
+Client Write IV[16]:
+| b4 e8 d8 92 28 9d d8 f5 18 e0 7f 31 43 c1 20 4a |....(......1C. J|
+Server Write IV[16]:
+| bd 18 be 1d 6d 00 7f c9 26 c7 57 9e 42 9d 83 ef |....m...&.W.B...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 679
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 194
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 180, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741
+ record: offset = 741, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750
+
+dissect_ssl enter frame #503 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338...
+looking for RSA pre-master41045172346374c18ca3903255dc325746d328a62dbde1b4...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.|
+| 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k|
+| 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 71 56 d7 fa 01 ff 15 62 7d 9b 9a ce 03 51 1c |&qV.....b}....Q.|
+| a7 df de 84 61 af f9 71 20 c4 fd d3 87 52 34 bf |....a..q ....R4.|
+| 26 77 b4 93 f8 e1 66 8f 05 35 c7 c5 61 25 77 1b |&w....f..5..a%w.|
+| 4a 55 b7 33 38 ea 0f f7 72 1a 67 e2 98 |JU.38...r.g.. |
+hash out[104]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y|
+| 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.|
+| 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.|
+| fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C|
+| 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.|
+| 96 e3 19 07 78 39 33 4d |....x93M |
+PRF out[104]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y|
+| 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.|
+| 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.|
+| fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C|
+| 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.|
+| 96 e3 19 07 78 39 33 4d |....x93M |
+key expansion[104]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y|
+| 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.|
+| 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.|
+| fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C|
+| 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.|
+| 96 e3 19 07 78 39 33 4d |....x93M |
+Client MAC key[20]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 |<.k. |
+Server MAC key[20]:
+| 30 ee 49 3c fb d8 10 c7 05 7c 13 79 3c 91 60 64 |0.I<.....|.y<.`d|
+| 2a 4e ed e4 |*N.. |
+Client Write key[16]:
+| de d9 bd 5c e4 4d 4e 87 7e a9 5a 6f 5b ac 18 dc |...\.MN.~.Zo[...|
+Server Write key[16]:
+| 28 1a 17 90 36 80 46 0e fb 4a 5a e3 73 e9 15 48 |(...6.F..JZ.s..H|
+Client Write IV[16]:
+| 1b d9 94 9e 81 f9 25 43 8f 95 5b af 06 3f 77 63 |......%C..[..?wc|
+Server Write IV[16]:
+| 14 7d 70 82 74 85 5c a5 96 e3 19 07 78 39 33 4d |.}p.t.\.....x93M|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.|
+| 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k|
+| 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a1 c1 46 05 29 05 f5 ed 80 3e 6d ca cb 26 66 be |..F.)....>m..&f.|
+| 56 90 62 c8 0b ee 38 91 71 c0 2f ca 8d ae 03 ad |V.b...8.q./.....|
+| b8 1f cb d8 62 a8 51 54 1f 95 e7 15 4b 90 7f e2 |....b.QT....K...|
+| f8 bf b8 9e 8b 0e f8 b6 fe d7 5f f7 18 1a 3b 60 |.........._...;`|
+Plaintext[64]:
+| 26 7d a6 22 45 f3 c6 ce 4d 75 84 3f 92 8d 57 ef |&}."E...Mu.?..W.|
+| 14 00 00 0c 39 8f f6 d9 2c 21 01 78 43 1b 26 fa |....9...,!.xC.&.|
+| e0 da 79 2a c4 14 00 0c 14 61 15 0a 07 66 56 fd |..y*.....a...fV.|
+| 98 8a 85 a2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e0 da 79 2a c4 14 00 0c 14 61 15 0a 07 66 56 fd |..y*.....a...fV.|
+| 98 8a 85 a2 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #504 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 06 45 ae f9 af 1a 81 4d 26 c4 63 c7 fd 3e b3 9c |.E.....M&.c..>..|
+| 16 d6 0f a2 95 bf 75 0d 5a 4b c4 df 06 8b 0e 99 |......u.ZK......|
+| 8f 0e 9b 9b fc e8 2f 5c 8e ba 9b 8a 49 3e 93 51 |....../\....I>.Q|
+| cc 6f 0e 9a 18 2a 46 5e 9e 10 4e ab f2 bb fe d9 |.o...*F^..N.....|
+Plaintext[64]:
+| 94 0e 11 48 51 3a 0b 9b 94 a9 43 7d 3f a3 70 69 |...HQ:....C}?.pi|
+| 14 00 00 0c a1 2f 1b 1f a6 87 0e e7 1d 08 05 fe |...../..........|
+| 4c cb 7a 61 12 8b e5 bc 76 2a fd 27 fc 9a 54 a2 |L.za....v*.'..T.|
+| ff 9e 5b 03 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..[.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4c cb 7a 61 12 8b e5 bc 76 2a fd 27 fc 9a 54 a2 |L.za....v*.'..T.|
+| ff 9e 5b 03 |..[. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #505 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 5b 32 33 80 67 98 f0 77 14 da 1d 98 43 59 16 49 |[23.g..w....CY.I|
+| 27 ae 49 2f aa 89 7a 77 a2 1f 2b cb 24 ff 93 ea |'.I/..zw..+.$...|
+| 5e ca 07 b9 1f 4e d7 f7 6d 53 d9 2d d2 e9 4b bf |^....N..mS.-..K.|
+| 8d 44 eb 28 52 b0 2a 36 a9 0b a8 2e 32 3b 59 13 |.D.(R.*6....2;Y.|
+| a2 1c 8d 6f 42 c2 1c ab 75 14 9d 48 04 a0 03 2c |...oB...u..H...,|
+| 95 00 d7 14 4e d3 3f 52 d1 52 3c ff 86 e6 f4 8d |....N.?R.R<.....|
+| f0 60 83 8b 85 19 18 04 26 4f 84 94 44 e4 3e 6a |.`......&O..D.>j|
+| 1b c3 17 25 cf b5 30 fd db b2 5b 6a cf df c6 32 |...%..0...[j...2|
+Plaintext[128]:
+| c5 d0 f3 8a f6 92 89 0d 9d cd 43 41 14 4f f7 39 |..........CA.O.9|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a 70 fc 2f d0 |.nl:4485....p./.|
+| d4 f6 49 2f 5a 35 1f 26 6f c9 a2 65 45 72 90 f4 |..I/Z5.&o..eEr..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 112
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 76 79 ac e0 65 55 32 b8 45 8b db 31 7f be 3a 0e |vy..eU2.E..1..:.|
+| 1d 9f a0 95 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 39630 found (nil)
+association_find: TCP port 4485 found 0x3430ed0
+
+dissect_ssl enter frame #506 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 80 7c 26 53 16 c3 6f fa 4e b1 0b 83 19 e9 6a 3b |.|&S..o.N.....j;|
+| 34 08 c9 54 17 b9 fd 53 6e b1 9a 45 3a b0 55 33 |4..T...Sn..E:.U3|
+| 98 8a b8 47 30 35 a9 5c a3 19 25 ec 6b 12 17 70 |...G05.\..%.k..p|
+| 8c a5 ba de b5 b1 11 2e 89 6c 4a 19 87 cc 08 9d |.........lJ.....|
+| 25 6e c1 d2 1f 13 92 e7 bc 2a 23 6c 19 13 a0 59 |%n.......*#l...Y|
+| 6e d2 a3 30 fc 64 6f b3 c2 d6 ec eb 00 e3 4e b5 |n..0.do.......N.|
+| 38 b3 83 34 f7 f4 26 c2 be 46 7d d0 35 8c 75 5d |8..4..&..F}.5.u]|
+| f8 9e 69 07 88 8f ae b6 9d 9f fb 93 c5 7e 73 a5 |..i..........~s.|
+| 5c 0f 90 f9 39 18 81 b5 c6 7a 6e 8c 2d 30 6c 54 |\...9....zn.-0lT|
+| f4 3e 0a 0d 56 82 e5 bb 73 32 a5 e9 0d ce f0 f4 |.>..V...s2......|
+| 0a d2 07 ad cd a8 db 9d c2 4b ff 28 ac d1 7d 82 |.........K.(..}.|
+| b3 52 7f 3b 4b ac 27 70 78 93 db 07 c6 25 1b dc |.R.;K.'px....%..|
+| 0a bc 8d 10 c2 5e d1 a1 3d 76 1b bf da dd a2 63 |.....^..=v.....c|
+| 86 94 60 2a 00 b4 68 c1 54 ba 3b 1a 57 0f 2e 7b |..`*..h.T.;.W..{|
+| 46 bf 89 03 67 b5 8f 79 f2 90 61 94 c9 d3 a7 cd |F...g..y..a.....|
+| d8 32 b0 33 e0 12 52 a8 fe dc 04 2d 3e aa 4e e9 |.2.3..R....->.N.|
+| 89 8e cd 7b 80 76 4b 34 22 8d 78 4d b9 d9 a9 fa |...{.vK4".xM....|
+| 80 34 c8 b0 8d 5c 91 4d 4a 07 b7 1d f2 46 02 8b |.4...\.MJ....F..|
+| 90 fb 2d a7 b1 5d 92 a9 e4 10 e5 a4 c3 0a 34 a9 |..-..]........4.|
+| 03 53 e5 a2 8a f0 82 82 01 49 3b b7 96 7b 89 10 |.S.......I;..{..|
+| 08 5e 75 bb 91 99 7f e1 1a 0e bc f4 ae 29 01 73 |.^u..........).s|
+| cf e4 88 fa 50 a5 ed de 9f b6 83 67 b7 45 38 ea |....P......g.E8.|
+| 55 62 b0 81 bc 38 68 02 20 a2 70 05 62 89 8c 17 |Ub...8h. .p.b...|
+| d8 1d 68 b4 3d fe 15 de 59 8a 65 18 8c c6 62 8f |..h.=...Y.e...b.|
+| 74 5f 66 de 21 aa 2e 9e d2 74 cf 40 88 4e 8e cf |t_f.!....t.@.N..|
+Plaintext[400]:
+| c2 cc 2a 67 87 4f 81 bd 18 26 5e ff da 38 7a 91 |..*g.O...&^..8z.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 10 09 c7 |.nl'</script>...|
+| e4 76 39 2a 21 64 9d 41 ff 81 7d 27 6d 78 21 57 |.v9*!d.A..}'mx!W|
+| 62 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |b...............|
+ssl_decrypt_record found padding 14 final len 385
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 04 59 eb b1 ac 1c 11 b4 8d 3f d2 9e e1 12 28 |..Y.......?....(|
+| 81 3b 8d 4c |.;.L |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4485 found 0x3430ed0
+
+dissect_ssl enter frame #507 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9b 73 db fb 73 23 d2 0b 97 1e 94 d4 94 08 41 dd |.s..s#........A.|
+| 8c c4 ce b2 35 79 cd 87 fb 7c d9 f7 9a 56 5c 5d |....5y...|...V\]|
+| ea 9c ca 29 31 d4 17 28 69 0f 68 7c a5 7c 53 98 |...)1..(i.h|.|S.|
+Plaintext[48]:
+| 44 6d 88 f1 45 a7 2a 3a c3 43 d1 5a e3 f0 57 ac |Dm..E.*:.C.Z..W.|
+| 01 00 0c 9c 89 8e 10 6c 5b 1a 77 f5 ce 0c 8f 76 |.......l[.w....v|
+| 42 ce 86 fd 85 5d 09 09 09 09 09 09 09 09 09 09 |B....]..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0c 9c 89 8e 10 6c 5b 1a 77 f5 ce 0c 8f 76 42 ce |.....l[.w....vB.|
+| 86 fd 85 5d |...] |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #509 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d8 50 4e 35 32 91 d7 a2 c0 7b 48 ef 68 c7 10 96 |.PN52....{H.h...|
+| 51 8d ba a7 e0 7c 9e 68 81 77 98 05 03 d1 3c 23 |Q....|.h.w....<#|
+| a9 cf 2a 08 d6 f4 41 76 61 51 f0 72 52 ac 07 19 |..*...AvaQ.rR...|
+Plaintext[48]:
+| f3 bd 87 f6 5f f2 79 05 bd 9c 06 19 18 e8 5c 0b |...._.y.......\.|
+| 01 00 62 77 fc 01 b2 af 45 00 f8 2a 23 37 7d 42 |..bw....E..*#7}B|
+| a3 e6 b2 7d 45 40 09 09 09 09 09 09 09 09 09 09 |...}E@..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 62 77 fc 01 b2 af 45 00 f8 2a 23 37 7d 42 a3 e6 |bw....E..*#7}B..|
+| b2 7d 45 40 |.}E@ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #514 (first time)
+ssl_session_init: initializing ptr 0x7facc385ef50 size 688
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 48166 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4486
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #516 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 750
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.|
+| 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k|
+| 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 1d 17 49 82 95 63 01 08 6e d9 2b ab 07 d2 cb |&..I..c..n.+....|
+| c2 f3 00 87 8f 81 35 45 61 98 f1 f4 38 52 34 bf |......5Ea...8R4.|
+| 26 21 49 16 45 7a 4a c3 9d 83 2c 5c e1 ab ea 41 |&!I.EzJ...,\...A|
+| 1f 00 f2 39 be 71 bd c0 87 f9 a3 72 32 |...9.q.....r2 |
+hash out[136]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.|
+| c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C|
+| a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..|
+| e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....|
+| 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...|
+| 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..|
+| 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r|
+| ce aa a9 e7 91 d5 16 7a |.......z |
+PRF out[136]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.|
+| c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C|
+| a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..|
+| e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....|
+| 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...|
+| 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..|
+| 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r|
+| ce aa a9 e7 91 d5 16 7a |.......z |
+key expansion[136]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.|
+| c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C|
+| a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..|
+| e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....|
+| 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...|
+| 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..|
+| 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r|
+| ce aa a9 e7 91 d5 16 7a |.......z |
+Client MAC key[20]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 |V.j. |
+Server MAC key[20]:
+| 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 c7 ee 3a a3 |...8..=|.)&...:.|
+| 2f 06 1a 65 |/..e |
+Client Write key[32]:
+| 59 34 80 fb ff 4c c1 43 a3 55 f7 15 9d 0a 10 96 |Y4...L.C.U......|
+| bb 94 4a e9 92 33 cd 95 e8 ae 8c be 72 3d b8 5b |..J..3......r=.[|
+Server Write key[32]:
+| 7e 8c 72 8d bf 83 96 02 5d 79 1a 77 ba 1d de e7 |~.r.....]y.w....|
+| 9c 85 d9 ca 6c 8d cd 09 12 0e 6a 7f 1e 30 50 98 |....l.....j..0P.|
+Client Write IV[16]:
+| dc 8f 0c 1a 3f 47 0b cb 9d 8a 7c a0 95 18 ae 73 |....?G....|....s|
+Server Write IV[16]:
+| e4 d8 e8 c1 f0 2d da 72 ce aa a9 e7 91 d5 16 7a |.....-.r.......z|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 679
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 194
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 180, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741
+ record: offset = 741, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750
+
+dissect_ssl enter frame #518 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be...
+looking for RSA pre-master4104b796016af771dcad1b81edf48ced974e752bb098d260...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....|
+| 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...|
+| d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 1d 17 49 82 95 63 01 08 6e d9 2b ab 07 d2 cb |&..I..c..n.+....|
+| c2 f3 00 87 8f 81 35 45 61 98 f1 f4 38 52 34 bf |......5Ea...8R4.|
+| 26 21 49 16 45 7a 4a c3 9d 83 2c 5c e1 ab ea 41 |&!I.EzJ...,\...A|
+| 1f 00 f2 39 be 71 bd c0 87 f9 a3 72 32 |...9.q.....r2 |
+hash out[136]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[|
+| f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...|
+| 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....|
+| b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}|
+| 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..|
+| 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$.<Y}..4..Aq.b|
+| f5 67 f7 5f 5d 38 dc ed 73 9f 25 90 7a fd a3 8c |.g._]8..s.%.z...|
+| 1a 53 f0 85 91 90 fb f8 |.S...... |
+PRF out[136]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[|
+| f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...|
+| 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....|
+| b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}|
+| 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..|
+| 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$.<Y}..4..Aq.b|
+| f5 67 f7 5f 5d 38 dc ed 73 9f 25 90 7a fd a3 8c |.g._]8..s.%.z...|
+| 1a 53 f0 85 91 90 fb f8 |.S...... |
+key expansion[136]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[|
+| f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...|
+| 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....|
+| b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}|
+| 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..|
+| 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$.<Y}..4..Aq.b|
+| f5 67 f7 5f 5d 38 dc ed 73 9f 25 90 7a fd a3 8c |.g._]8..s.%.z...|
+| 1a 53 f0 85 91 90 fb f8 |.S...... |
+Client MAC key[20]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f |.J.o |
+Server MAC key[20]:
+| b6 e2 92 c4 17 69 b3 25 5d 46 37 5b f1 51 46 3b |.....i.%]F7[.QF;|
+| 24 1f 78 a2 |$.x. |
+Client Write key[32]:
+| 8c 5e 82 f8 36 d9 cc d4 4b 68 c3 9a 9d 9c 65 27 |.^..6...Kh....e'|
+| 6a 77 21 6f d4 1f bb a1 b7 a8 0b 46 29 40 15 fb |jw!o.......F)@..|
+Server Write key[32]:
+| 61 e5 49 42 45 85 53 7d 78 75 a5 b3 43 2a c6 21 |a.IBE.S}xu..C*.!|
+| 07 67 38 71 eb 7a 9c 14 07 e5 24 a8 3c 59 7d c0 |.g8q.z....$.<Y}.|
+Client Write IV[16]:
+| 89 34 b2 12 41 71 87 62 f5 67 f7 5f 5d 38 dc ed |.4..Aq.b.g._]8..|
+Server Write IV[16]:
+| 73 9f 25 90 7a fd a3 8c 1a 53 f0 85 91 90 fb f8 |s.%.z....S......|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....|
+| 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...|
+| d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 4a 57 4a 80 30 d0 18 20 e3 de 03 2e 95 99 71 78 |JWJ.0.. ......qx|
+| 80 a3 e1 ec ae fd e8 eb 16 90 59 5e 47 e0 51 8f |..........Y^G.Q.|
+| 23 0f 56 ae 09 5a bc b6 ce a4 f9 5e 30 75 08 55 |#.V..Z.....^0u.U|
+| 00 9a 38 de 1b d3 e6 09 b1 7c 8c a0 0d 02 88 48 |..8......|.....H|
+Plaintext[64]:
+| fc 67 be 64 e3 79 75 67 9b ac f2 29 5d 16 3e f6 |.g.d.yug...)].>.|
+| 14 00 00 0c 93 d9 61 28 a3 1f a7 bd 3e 31 8f 93 |......a(....>1..|
+| 45 a9 4a 29 49 80 d3 14 78 90 23 35 aa b2 69 2f |E.J)I...x.#5..i/|
+| c7 f4 14 8f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 45 a9 4a 29 49 80 d3 14 78 90 23 35 aa b2 69 2f |E.J)I...x.#5..i/|
+| c7 f4 14 8f |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #519 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 28 2b 33 59 8b 05 e9 31 60 30 04 e6 27 d6 05 54 |(+3Y...1`0..'..T|
+| 4d e8 27 61 c1 68 43 f4 1f 1c 6c a5 e0 44 b5 49 |M.'a.hC...l..D.I|
+| 39 d5 0e 3e dc 4f 3e fe 8a ad 6a 81 ee f9 73 7d |9..>.O>...j...s}|
+| c4 75 1a a9 f9 92 72 28 68 5c 3c ca 15 a8 81 a1 |.u....r(h\<.....|
+Plaintext[64]:
+| d0 f2 0d ac 72 be 66 e9 83 17 40 ff c5 20 41 3f |....r.f...@.. A?|
+| 14 00 00 0c d2 d3 c7 2e be 8c 5e 86 fd 6b 31 20 |..........^..k1 |
+| 78 64 aa 67 e8 2d 60 9d 66 24 78 4e 4d 89 67 dd |xd.g.-`.f$xNM.g.|
+| b0 d5 b5 c7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 78 64 aa 67 e8 2d 60 9d 66 24 78 4e 4d 89 67 dd |xd.g.-`.f$xNM.g.|
+| b0 d5 b5 c7 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #520 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| c1 6c b4 be 02 d2 8d d8 8a 0d 25 5b 7f 2c b1 c4 |.l........%[.,..|
+| 0d f0 82 4c d6 d0 bf d5 55 5c 4f e1 8a 2d 37 06 |...L....U\O..-7.|
+| 30 17 d8 ba 48 e3 36 71 3b 80 a7 83 1f fe e9 7f |0...H.6q;.......|
+| 2f 91 f0 1a f3 8a 49 75 a6 0e 3e b2 de 50 40 fb |/.....Iu..>..P@.|
+| 59 eb 72 f7 fb 80 e7 d6 05 16 26 0f a9 fa 5b e5 |Y.r.......&...[.|
+| 31 3d 99 0e f8 be ae 23 79 3b 5f 7e d9 25 1b b9 |1=.....#y;_~.%..|
+| 7d 02 de 29 20 d6 6b 64 90 b0 7e f8 99 5b 4c c2 |}..) .kd..~..[L.|
+| a7 60 fa 58 b6 d5 56 dd b2 cf 49 bd 67 8b 37 b4 |.`.X..V...I.g.7.|
+Plaintext[128]:
+| 2a 6b 15 42 04 6d 93 85 dd 8b f9 e3 dc 29 af 36 |*k.B.m.......).6|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a ef c9 47 c8 |.nl:4486......G.|
+| c3 10 9c 61 c5 26 54 1d 13 0e 12 d5 61 2c 0c 21 |...a.&T.....a,.!|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 112
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 95 66 5b 10 09 6d db 3e c2 bf a6 a1 e2 87 54 d1 |.f[..m.>......T.|
+| 70 e6 bf 5b |p..[ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 48166 found (nil)
+association_find: TCP port 4486 found 0x3430f60
+
+dissect_ssl enter frame #521 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e5 c4 9c c4 15 61 f8 ff fd 42 16 fc 66 51 d1 49 |.....a...B..fQ.I|
+| 5b 8b ae eb 95 d1 b2 7d 28 b5 7e 16 43 24 42 b8 |[......}(.~.C$B.|
+| a2 00 7b 87 2a 66 a7 b8 79 72 61 8f 58 0d 5b 5d |..{.*f..yra.X.[]|
+| 13 a3 4f 0c 64 a5 df 8a 5d 9f fc 90 5c 4a 73 78 |..O.d...]...\Jsx|
+| ca 50 49 8b 71 49 24 9e c3 c5 73 0f 63 92 56 8c |.PI.qI$...s.c.V.|
+| 09 4d 55 84 d6 63 1d 34 36 f9 c6 05 19 ac 8c 03 |.MU..c.46.......|
+| 19 48 62 da 4a 67 05 01 75 7a ce bb 56 3f 6f 65 |.Hb.Jg..uz..V?oe|
+| a6 fb b7 24 f7 df 67 83 66 0c 23 fb 3b b0 94 de |...$..g.f.#.;...|
+| 3d 5a c2 47 a7 5e e1 64 a9 f4 ea 47 6c da 18 cc |=Z.G.^.d...Gl...|
+| ea 6e 05 41 7a aa 28 9d 54 00 0f 8f dd 7b 3a 2f |.n.Az.(.T....{:/|
+| a0 8a f6 61 66 af 99 32 ed c8 00 15 ce 27 7b 21 |...af..2.....'{!|
+| 4a 5a e9 51 76 cc 4d d3 a5 5f ac 41 ee 21 d7 01 |JZ.Qv.M.._.A.!..|
+| 88 6a 30 5b aa 1b 6c c4 5a c3 49 5f 8b a6 d4 23 |.j0[..l.Z.I_...#|
+| 71 ba 26 79 8c e0 81 50 19 63 ab 0a 1a 52 8e 28 |q.&y...P.c...R.(|
+| eb dd 4e 53 e9 22 70 d6 5e c7 5c 49 b9 84 53 28 |..NS."p.^.\I..S(|
+| 85 bd 12 0d 69 0a 96 44 ec 60 b3 db 9e 3e 5a 37 |....i..D.`...>Z7|
+| f9 04 ef 36 70 62 11 70 c3 96 50 12 25 18 7c a2 |...6pb.p..P.%.|.|
+| 7a 97 60 ae 31 07 98 bc 02 a3 c8 92 7b 95 b2 2d |z.`.1.......{..-|
+| dd b1 c4 c1 a5 b5 b6 e1 d0 6a 4d 6c 1b 46 be 5a |.........jMl.F.Z|
+| d9 b5 e2 e4 e6 49 e9 4d 1f f7 2b ca 20 63 67 d2 |.....I.M..+. cg.|
+| dd b8 b1 46 ac b7 fc 01 f6 9f f5 b0 43 66 d3 ec |...F........Cf..|
+| fc e6 22 01 cc 68 37 dd 11 6b d4 e3 21 91 3a fb |.."..h7..k..!.:.|
+| ea 40 bb 38 8c 95 dd 70 38 de d7 a0 2b 66 06 cc |.@.8...p8...+f..|
+| 79 38 8e 7d d0 98 ab 64 52 7e e2 24 4d b9 65 c0 |y8.}...dR~.$M.e.|
+| 7a ad 51 4f 25 12 35 b4 01 c5 7e 92 2d f5 1b 42 |z.QO%.5...~.-..B|
+Plaintext[400]:
+| e6 3e 5c 96 06 2e a4 70 a7 58 3a 5a 78 3d 6a 14 |.>\....p.X:Zx=j.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ac 9e e7 |.nl'</script>...|
+| 7a f7 c3 96 8f fd 57 31 af b8 f0 fd b8 51 45 70 |z.....W1.....QEp|
+| b4 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 385
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 9a c5 1d 56 8c a5 21 6a 92 8c 09 31 01 b9 8e |....V..!j...1...|
+| 90 09 a8 87 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4486 found 0x3430f60
+
+dissect_ssl enter frame #522 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b9 be 9e b1 fe 22 91 9d 9f 5b 1b 3b d7 a2 a1 4c |....."...[.;...L|
+| a6 a9 64 0c b6 2a f6 77 25 be 63 0c 57 8c 4e 59 |..d..*.w%.c.W.NY|
+| b1 c0 16 7b 2f 05 a6 a2 60 e9 e0 d7 5f da 4d de |...{/...`..._.M.|
+Plaintext[48]:
+| c9 63 38 c9 1f 7b e2 32 4c 53 87 08 a1 3d 3f 29 |.c8..{.2LS...=?)|
+| 01 00 c0 5e 0b 48 f9 ef 00 38 04 9e 69 cf ab 19 |...^.H...8..i...|
+| 1f f1 e4 cf 78 b6 09 09 09 09 09 09 09 09 09 09 |....x...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c0 5e 0b 48 f9 ef 00 38 04 9e 69 cf ab 19 1f f1 |.^.H...8..i.....|
+| e4 cf 78 b6 |..x. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #524 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c9 36 0f 15 31 65 21 e1 dd 68 d6 16 d3 c0 a7 27 |.6..1e!..h.....'|
+| 1f 64 aa f6 4e 12 88 10 32 57 7a 2e 4c 04 27 be |.d..N...2Wz.L.'.|
+| f3 ee 15 07 1c 01 e6 59 06 56 37 c1 2c 70 41 fe |.......Y.V7.,pA.|
+Plaintext[48]:
+| a9 c4 f0 c5 40 e2 ea ba 1f 98 00 3d 48 b1 43 74 |....@......=H.Ct|
+| 01 00 91 24 a6 88 14 43 8f ff 91 c7 5a 2c ec fe |...$...C....Z,..|
+| 6c 80 09 b9 45 61 09 09 09 09 09 09 09 09 09 09 |l...Ea..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 91 24 a6 88 14 43 8f ff 91 c7 5a 2c ec fe 6c 80 |.$...C....Z,..l.|
+| 09 b9 45 61 |..Ea |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #529 (first time)
+ssl_session_init: initializing ptr 0x7facc3861410 size 688
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 57501 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4491
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #531 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC011 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....|
+| 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...|
+| d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 54 48 16 d3 cd 07 60 9f 77 62 60 51 f0 f4 79 |&TH....`.wb`Q..y|
+| 00 e3 f1 66 90 46 20 6e 28 70 93 eb 20 52 34 bf |...f.F n(p.. R4.|
+| 26 c8 be 86 bf b1 14 f1 61 cf ec 4d 6f d9 a4 61 |&.......a..Mo..a|
+| 17 e4 4d 82 f6 8e 38 1c 7d 69 27 01 f7 |..M...8.}i'.. |
+hash out[72]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_|
+| 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;|
+| 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\|
+| b7 d9 51 bf c3 f0 36 0c |..Q...6. |
+PRF out[72]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_|
+| 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;|
+| 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\|
+| b7 d9 51 bf c3 f0 36 0c |..Q...6. |
+key expansion[72]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_|
+| 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;|
+| 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\|
+| b7 d9 51 bf c3 f0 36 0c |..Q...6. |
+Client MAC key[20]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf |7.j. |
+Server MAC key[20]:
+| fb 50 89 e5 61 84 48 08 d0 52 40 5f 56 7a 01 f3 |.P..a.H..R@_Vz..|
+| 4e 10 82 91 |N... |
+Client Write key[16]:
+| ec 3a ef 45 ce 8f f9 3b 0f 5e c1 91 e2 03 35 82 |.:.E...;.^....5.|
+Server Write key[16]:
+| 87 82 b9 1c ab 07 d8 5c b7 d9 51 bf c3 f0 36 0c |.......\..Q...6.|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #533 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f6...
+looking for RSA pre-master4104ea3d5891a5452e2664fae464b13c68e6d659a0d51bba...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..|
+| ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.|
+| 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 54 48 16 d3 cd 07 60 9f 77 62 60 51 f0 f4 79 |&TH....`.wb`Q..y|
+| 00 e3 f1 66 90 46 20 6e 28 70 93 eb 20 52 34 bf |...f.F n(p.. R4.|
+| 26 c8 be 86 bf b1 14 f1 61 cf ec 4d 6f d9 a4 61 |&.......a..Mo..a|
+| 17 e4 4d 82 f6 8e 38 1c 7d 69 27 01 f7 |..M...8.}i'.. |
+hash out[72]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf|
+| fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A|
+| ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G|
+| 77 5f 96 38 f1 48 22 fe |w_.8.H". |
+PRF out[72]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf|
+| fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A|
+| ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G|
+| 77 5f 96 38 f1 48 22 fe |w_.8.H". |
+key expansion[72]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf|
+| fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A|
+| ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G|
+| 77 5f 96 38 f1 48 22 fe |w_.8.H". |
+Client MAC key[20]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 |.D.V |
+Server MAC key[20]:
+| 15 78 34 7e a2 88 dd 51 f2 2f 67 66 fc 52 52 8e |.x4~...Q./gf.RR.|
+| 78 51 d6 56 |xQ.V |
+Client Write key[16]:
+| d4 bf 40 1f bf 39 c4 41 ad 9a 53 d9 f6 eb 8d 8a |..@..9.A..S.....|
+Server Write key[16]:
+| 4c b1 f2 62 68 91 3f 47 77 5f 96 38 f1 48 22 fe |L..bh.?Gw_.8.H".|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..|
+| ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.|
+| 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 63 0c b4 36 af 40 02 fc 08 c8 24 f7 2e f3 ca a6 |c..6.@....$.....|
+| 72 07 ee 48 c5 e0 78 1a a5 b0 74 29 ed cc 9a ce |r..H..x...t)....|
+| 5c ad dc d2 |\... |
+Plaintext[36]:
+| 14 00 00 0c 1f a1 4a 75 76 c8 9c 7c 6c 22 e2 4c |......Juv..|l".L|
+| 05 a0 ef b1 a8 00 d8 9f da bd 75 4c 50 9e 04 be |..........uLP...|
+| 39 aa 0c b4 |9... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 05 a0 ef b1 a8 00 d8 9f da bd 75 4c 50 9e 04 be |..........uLP...|
+| 39 aa 0c b4 |9... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #534 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 1a a6 19 a1 55 f1 6c 65 10 27 08 ad 0c 3c 0f 7e |....U.le.'...<.~|
+| 4b e0 90 47 26 e5 97 4d d3 75 d1 1f 6f 5b 15 6e |K..G&..M.u..o[.n|
+| 55 92 4d d3 |U.M. |
+Plaintext[36]:
+| 14 00 00 0c b3 19 f6 37 e4 56 be 99 32 d4 d1 5a |.......7.V..2..Z|
+| 71 f7 cf 2a db 3b 14 d6 b8 5c b6 e3 51 44 02 6e |q..*.;...\..QD.n|
+| 2c a8 cf 4a |,..J |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 71 f7 cf 2a db 3b 14 d6 b8 5c b6 e3 51 44 02 6e |q..*.;...\..QD.n|
+| 2c a8 cf 4a |,..J |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #535 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 96
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 91, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 91
+Ciphertext[91]:
+| 03 c4 fe d6 32 19 9e 23 82 79 a1 8d 42 14 5e 4d |....2..#.y..B.^M|
+| ea e9 54 65 1b 74 be fb c8 37 ac 51 e0 f6 8b 48 |..Te.t...7.Q...H|
+| f0 fa b2 e5 60 e5 16 75 71 b8 04 9b e6 8c 83 92 |....`..uq.......|
+| 3a 7f 48 b8 eb d7 0b 4c 7d bc 87 9d 44 50 fe 89 |:.H....L}...DP..|
+| e6 4f cb d3 1f 13 21 a5 ab ab b9 e6 b7 dc 5e fd |.O....!.......^.|
+| 0f c0 ef 9b 70 a5 d7 43 89 7f ac |....p..C... |
+Plaintext[91]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a 93 11 f4 3a e1 af 2a 80 60 |491.......:..*.`|
+| 9e 35 ab 35 c9 a3 a5 0f ba e5 b7 |.5.5....... |
+checking mac (len 71, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 93 11 f4 3a e1 af 2a 80 60 9e 35 ab 35 c9 a3 a5 |...:..*.`.5.5...|
+| 0f ba e5 b7 |.... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 71, seq = 0, nxtseq = 71
+association_find: TCP port 57501 found (nil)
+association_find: TCP port 4491 found 0x3431840
+dissect_ssl3_record decrypted len 71
+decrypted app data fragment[71]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a |491.... |
+dissect_ssl3_record found association 0x3431840
+
+dissect_ssl enter frame #536 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| ea 1a dc 71 3a e8 49 57 84 35 3b a9 4f 54 f2 a4 |...q:.IW.5;.OT..|
+| 1e f7 61 e5 c0 84 8d 7a 5d a8 64 13 79 04 08 3a |..a....z].d.y..:|
+| 78 f3 ca fc cb f9 82 d6 78 85 ae e0 2c e3 4c 30 |x.......x...,.L0|
+| 7e c8 9b bb 38 b1 4e 37 fe 62 da 37 2f 6e 81 fc |~...8.N7.b.7/n..|
+| c1 ea 66 a7 da 12 cf 70 7f cb b7 3a 26 10 e8 86 |..f....p...:&...|
+| d3 96 30 6c 3a 49 1a 97 d2 9c e1 f2 c8 34 a7 9b |..0l:I.......4..|
+| 18 e1 59 c2 9d 89 09 e7 00 a0 40 86 49 7c 0e 10 |..Y.......@.I|..|
+| e2 77 40 6f ad cd ca 05 e6 29 09 6e f2 1f 96 ee |.w@o.....).n....|
+| 3c bf 32 bb 39 a8 da 5a 79 74 ec 0f 68 27 6b 75 |<.2.9..Zyt..h'ku|
+| b6 69 6e e1 8c 80 99 af 00 a1 3d c8 30 b7 4e 51 |.in.......=.0.NQ|
+| 60 77 d2 02 a9 16 a3 1b 91 c1 c9 00 8d 24 49 48 |`w...........$IH|
+| 8f 59 51 94 3b 70 2a fe 25 26 0a 17 ea e2 9e 8c |.YQ.;p*.%&......|
+| 95 fe 27 29 9d 6a fb 23 b0 fd a6 84 1e 5e b5 34 |..').j.#.....^.4|
+| ee cc 6a 92 05 84 cb 36 e1 a0 4c 5b 13 99 3d f3 |..j....6..L[..=.|
+| 76 3f 85 35 0f bd 81 f0 99 bd 54 5b 2a 6b 55 dd |v?.5......T[*kU.|
+| 2e dc 6e df 7f 51 3c 66 89 76 35 e2 09 ab 85 e3 |..n..Q<f.v5.....|
+| 46 d9 49 b2 05 4f c6 9b 80 95 21 29 b5 40 05 97 |F.I..O....!).@..|
+| 7a 03 a0 45 06 69 5f 91 33 91 f7 ba 50 5e eb 71 |z..E.i_.3...P^.q|
+| 25 cc c9 2f 78 90 86 b0 bf 21 a9 71 66 f6 81 46 |%../x....!.qf..F|
+| 95 30 28 5e 30 0f 7c b5 ea 82 c0 a2 2b bf 1e 71 |.0(^0.|.....+..q|
+| b4 7d 50 4a 8e 66 eb ae eb f0 ba 72 c4 8c 32 8b |.}PJ.f.....r..2.|
+| a3 ad f8 13 92 05 fe 1d 43 48 1e 5a 9f 2c 3c 71 |........CH.Z.,<q|
+| 33 d4 12 8f b3 13 49 4f 1a 4e 0c a4 09 9f f0 0d |3.....IO.N......|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ab a5 3d 92 |nl'</script>..=.|
+| e1 a1 74 03 2e ee 44 94 eb fb 46 bf c1 b0 ab d1 |..t...D...F.....|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ab a5 3d 92 e1 a1 74 03 2e ee 44 94 eb fb 46 bf |..=...t...D...F.|
+| c1 b0 ab d1 |.... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4491 found 0x3431840
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3431840
+
+dissect_ssl enter frame #537 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 17 1f 56 00 42 af 59 ed 14 72 0d 9b bd ae c6 f6 |..V.B.Y..r......|
+| 94 5b cc ff 20 96 |.[.. . |
+Plaintext[22]:
+| 01 00 e1 74 23 83 48 30 f3 84 07 e4 15 cf 10 0b |...t#.H0........|
+| 7c eb 9f c5 d8 5d ||....] |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 74 23 83 48 30 f3 84 07 e4 15 cf 10 0b 7c eb |.t#.H0........|.|
+| 9f c5 d8 5d |...] |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #539 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 38 00 8b 45 cb 30 36 09 3e 69 16 08 49 66 be af |8..E.06.>i..If..|
+| b0 b4 30 1f cc 25 |..0..% |
+Plaintext[22]:
+| 01 00 50 dd 9e c8 b8 83 66 09 ea 7b 07 17 3b a1 |..P.....f..{..;.|
+| bf 7b de d4 9d e5 |.{.... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 50 dd 9e c8 b8 83 66 09 ea 7b 07 17 3b a1 bf 7b |P.....f..{..;..{|
+| de d4 9d e5 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #544 (first time)
+ssl_session_init: initializing ptr 0x7facc3863d20 size 688
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34592 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4492
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #546 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..|
+| ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.|
+| 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 e5 39 48 98 98 bf fa 5b 4d 1e 24 c8 88 c7 30 |&.9H....[M.$...0|
+| e7 0b 48 99 89 63 f6 10 fa 0c 1c 1f 10 52 34 bf |..H..c.......R4.|
+| 26 d7 23 92 e6 c6 7c c5 69 c9 dc 18 61 0f fd df |&.#...|.i...a...|
+| 12 47 42 b6 8e f9 50 e4 35 7b 73 1a 99 |.GB...P.5{s.. |
+hash out[104]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o|
+| d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..|
+| 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..|
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h|
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+PRF out[104]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o|
+| d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..|
+| 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..|
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h|
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+key expansion[104]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o|
+| d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..|
+| 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..|
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h|
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+Client MAC key[20]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e |.A.^ |
+Server MAC key[20]:
+| 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f d3 5d 9f fc |..&a4......o.]..|
+| 53 20 52 6e |S Rn |
+Client Write key[24]:
+| 3e 96 18 82 b4 45 c5 1c 93 65 6f 96 76 b5 2c 54 |>....E...eo.v.,T|
+| 1f 7f 4c ce cb 4d 89 ee |..L..M.. |
+Server Write key[24]:
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 |(..'Wt.. |
+Client Write IV[8]:
+| 26 03 a8 e7 05 fc cf 68 |&......h |
+Server Write IV[8]:
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #548 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68e...
+looking for RSA pre-master4104eebcabcbcb46841a360b5987f25cde894bce45b8777e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.|
+| 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.|
+| 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 e5 39 48 98 98 bf fa 5b 4d 1e 24 c8 88 c7 30 |&.9H....[M.$...0|
+| e7 0b 48 99 89 63 f6 10 fa 0c 1c 1f 10 52 34 bf |..H..c.......R4.|
+| 26 d7 23 92 e6 c6 7c c5 69 c9 dc 18 61 0f fd df |&.#...|.i...a...|
+| 12 47 42 b6 8e f9 50 e4 35 7b 73 1a 99 |.GB...P.5{s.. |
+hash out[104]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n|
+| b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF|
+| a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...|
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF|
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+PRF out[104]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n|
+| b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF|
+| a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...|
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF|
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+key expansion[104]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n|
+| b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF|
+| a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...|
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF|
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+Client MAC key[20]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 |...u |
+Server MAC key[20]:
+| c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e b0 63 8a 48 |.....8.o.^.n.c.H|
+| ef 8c b8 9e |.... |
+Client Write key[24]:
+| 84 ed e3 89 57 0e 75 46 a2 2e ff f8 cd bc 14 88 |....W.uF........|
+| e4 c4 a2 1c 42 d9 bd 13 |....B... |
+Server Write key[24]:
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 |..n'..8. |
+Client Write IV[8]:
+| 09 4f 36 d1 e8 d0 7a 46 |.O6...zF |
+Server Write IV[8]:
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.|
+| 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.|
+| 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| a2 32 a0 6b 7d bd 41 bc ea 88 38 15 fb ec c0 8f |.2.k}.A...8.....|
+| 65 77 61 73 06 29 de 95 68 49 f5 f3 e7 0e a2 e8 |ewas.)..hI......|
+| 45 18 a0 3d 2c b1 53 30 57 c2 d9 d3 87 d6 d3 80 |E..=,.S0W.......|
+Plaintext[48]:
+| 96 bf b5 57 84 89 ea c9 14 00 00 0c e5 ed 95 02 |...W............|
+| a0 35 36 a5 e0 04 77 2c 3e 6e 31 b3 9f 64 16 87 |.56...w,>n1..d..|
+| 0c a9 c2 1c f8 22 a5 6e 14 58 bc 89 03 03 03 03 |.....".n.X......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e 6e 31 b3 9f 64 16 87 0c a9 c2 1c f8 22 a5 6e |>n1..d.......".n|
+| 14 58 bc 89 |.X.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #549 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 52 96 93 fd ce ca f6 fa 14 44 a7 22 6f 72 dc 49 |R........D."or.I|
+| e8 97 cf f5 70 eb 93 3d b9 7d c1 c5 a4 02 e7 15 |....p..=.}......|
+| 3e 07 22 dd 69 08 64 32 47 35 c0 89 ed 93 a7 e1 |>.".i.d2G5......|
+Plaintext[48]:
+| 26 18 e2 17 1b c2 1f 19 14 00 00 0c 3b 15 3c 03 |&...........;.<.|
+| ba 4c 95 4e af 14 e0 d7 8b 93 42 04 1b be ea cf |.L.N......B.....|
+| 27 61 fb 88 cd a2 05 77 1a 03 2b d5 03 03 03 03 |'a.....w..+.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8b 93 42 04 1b be ea cf 27 61 fb 88 cd a2 05 77 |..B.....'a.....w|
+| 1a 03 2b d5 |..+. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #550 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 9b 0b 21 f5 40 3e a0 f6 33 51 e5 e6 92 68 fc 97 |..!.@>..3Q...h..|
+| 36 3b fb 54 31 09 3c b2 6e 8e 66 d6 96 7b 06 b8 |6;.T1.<.n.f..{..|
+| 4c 33 10 3b a6 dd 1d 8f 5e 01 48 68 c6 c9 e5 25 |L3.;....^.Hh...%|
+| b5 f7 b4 89 56 db 66 f4 07 e4 08 48 c1 88 0c 5f |....V.f....H..._|
+| 8c cb 5e 3a af 8c 4d 46 31 3f 08 f2 28 75 59 44 |..^:..MF1?..(uYD|
+| a1 78 95 b1 ea f4 eb c4 2c e4 64 2f b2 03 5b ee |.x......,.d/..[.|
+| 62 5f b9 a9 39 3c 5d e9 61 f2 f6 43 c9 37 76 6d |b_..9<].a..C.7vm|
+Plaintext[112]:
+| b2 26 f3 4a 21 50 23 44 47 45 54 20 2f 20 48 54 |.&.J!P#DGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 65 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 |dhe-rsa-des-cbc3|
+| 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 |-sha.local.al.le|
+| 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 39 32 |kensteyn.nl:4492|
+| 0d 0a 0d 0a 36 40 ce 3e e1 92 01 e6 93 32 8c 19 |....6@.>.....2..|
+| a6 67 46 d5 7d 3c 2e 32 07 07 07 07 07 07 07 07 |.gF.}<.2........|
+ssl_decrypt_record found padding 7 final len 104
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ec c3 4a d5 b1 fb a4 c8 74 d8 64 72 2c 17 0d fe |..J.....t.dr,...|
+| d9 bb de ce |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34592 found (nil)
+association_find: TCP port 4492 found 0x34318d0
+
+dissect_ssl enter frame #551 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c9 d1 11 f4 7b cc 69 dd bf 7c ab a2 bf c7 ca 2a |....{.i..|.....*|
+| 88 46 f4 a6 35 96 29 d2 31 95 41 e7 01 61 b6 e1 |.F..5.).1.A..a..|
+| 79 ed 5f fd 0c 2c 0d 6a b0 f9 0f 98 4c d9 27 14 |y._..,.j....L.'.|
+| 58 5f 6f 87 3b d8 43 2a b6 54 85 52 6b 26 6c b3 |X_o.;.C*.T.Rk&l.|
+| bf ea da a8 5c d6 eb 42 78 2d 88 c9 d2 8c fc e2 |....\..Bx-......|
+| 59 a8 19 2c 18 2a fe 40 1a 9a c6 30 d8 5f de 5d |Y..,.*.@...0._.]|
+| 19 e0 63 41 f6 12 b3 57 1b f6 af 33 a7 87 24 38 |..cA...W...3..$8|
+| 18 0c 92 4c 02 f6 77 2c e1 8c fd 3e 63 97 5c f5 |...L..w,...>c.\.|
+| 88 58 52 36 a5 6f d0 26 c6 03 93 23 d0 73 4e cb |.XR6.o.&...#.sN.|
+| 71 73 da 4b e7 e0 75 2f 7b 06 43 90 f6 0e 2e 35 |qs.K..u/{.C....5|
+| 94 e6 b2 0e d9 db 4a 3b 23 12 42 92 11 0b 66 d0 |......J;#.B...f.|
+| a0 36 6e d5 6b eb 8a e2 3a 0e 28 6e 38 75 5e 02 |.6n.k...:.(n8u^.|
+| 93 5f 11 b6 15 d2 40 77 c7 ac 58 11 0a 78 5c 2f |._....@w..X..x\/|
+| 35 88 9a d6 8d 85 1f fb b1 8e ef 3d 4b 0e 88 c1 |5..........=K...|
+| ed 7e fe 21 a9 a3 12 a0 83 30 44 3d 91 6d 18 4d |.~.!.....0D=.m.M|
+| 21 80 c5 c6 52 85 af 15 13 20 01 89 50 e7 a4 d3 |!...R.... ..P...|
+| d8 63 f2 09 74 e1 c7 6d 7b 1b 00 c0 f6 b5 08 85 |.c..t..m{.......|
+| 69 63 99 6a a3 77 26 05 38 6f 9f 72 bf 01 a1 95 |ic.j.w&.8o.r....|
+| db 06 0b 0b 68 bb 05 cd 21 0a 31 2d d7 29 91 28 |....h...!.1-.).(|
+| ff ef 30 12 8a 4d 69 0c 0f 37 ea 22 85 db 45 83 |..0..Mi..7."..E.|
+| c5 10 e4 df d8 a1 85 07 c4 99 35 df ed d9 c6 b7 |..........5.....|
+| 94 2e 54 3b bc e4 2b 3a b5 e9 56 30 11 1a 40 60 |..T;..+:..V0..@`|
+| 58 dc e5 5c f3 1b 23 1e f1 6b d3 5d ce 34 91 76 |X..\..#..k.].4.v|
+| 6e 5c ed fd b0 b0 1d 5d be 89 6f 47 67 99 b2 f9 |n\.....]..oGg...|
+Plaintext[384]:
+| 48 9b 94 99 84 7c ab 56 48 54 54 50 2f 31 2e 31 |H....|.VHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 38 20 47 4d |2013 19:55:18 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 31 32 |che....0xC0,0x12|
+| 20 2d 20 45 43 44 48 45 2d 52 53 41 2d 44 45 53 | - ECDHE-RSA-DES|
+| 2d 43 42 43 33 2d 53 48 41 20 20 53 53 4c 76 33 |-CBC3-SHA SSLv3|
+| 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 3d | Kx=ECDH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e af c1 91 8f f4 7a 7b 7e 2f ce f0 f3 |ipt>.....z{~/...|
+| c5 2c 0a 7a 35 86 16 48 07 07 07 07 07 07 07 07 |.,.z5..H........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0b 8c 9f fa 5c b9 86 2d da 90 1c fb 95 12 64 c4 |....\..-......d.|
+| ec cf 31 5d |..1] |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4492 found 0x34318d0
+
+dissect_ssl enter frame #552 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 13 87 84 14 ce 22 02 a6 e7 19 a7 17 d7 db cd 9e |....."..........|
+| 21 a9 30 2c 83 a5 3d be 91 bf 60 e4 49 ce 08 68 |!.0,..=...`.I..h|
+Plaintext[32]:
+| c6 d3 ea d3 d3 52 73 cf 01 00 b0 ca 07 80 79 bd |.....Rs.......y.|
+| 4f 17 18 cc 24 2a 62 6e c1 93 e7 fe f9 1e 01 01 |O...$*bn........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b0 ca 07 80 79 bd 4f 17 18 cc 24 2a 62 6e c1 93 |....y.O...$*bn..|
+| e7 fe f9 1e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #554 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ad 0e 58 f1 8d c2 d9 eb 7d b2 93 07 5c 0d da f0 |..X.....}...\...|
+| 7a d6 16 93 12 5c f1 63 0a 11 67 f6 ca 86 89 9a |z....\.c..g.....|
+Plaintext[32]:
+| 00 94 e0 88 23 72 8f 91 01 00 f3 37 24 45 dd 05 |....#r.....7$E..|
+| fa ae 86 00 9b ce dc ef 85 1f 16 23 75 c9 01 01 |...........#u...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f3 37 24 45 dd 05 fa ae 86 00 9b ce dc ef 85 1f |.7$E............|
+| 16 23 75 c9 |.#u. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #559 (first time)
+ssl_session_init: initializing ptr 0x7facc3866220 size 688
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55294 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4493
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #561 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.|
+| 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.|
+| 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 25 87 db 66 ce 4f af b1 e8 4f 7d a8 a9 66 d5 |'%..f.O...O}..f.|
+| 42 14 31 0f 64 4e cf ec d2 18 38 7e b1 52 34 bf |B.1.dN....8~.R4.|
+| 27 0d 31 84 a1 0d fb a3 73 43 ad 12 f1 15 c7 08 |'.1.....sC......|
+| e3 e7 46 e8 8e ff 05 15 a4 37 35 7f bc |..F......75.. |
+hash out[104]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..|
+| 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..|
+| 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d|
+| cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu|
+| f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U|
+| 19 8d 7d b8 fc 26 ea 93 |..}..&.. |
+PRF out[104]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..|
+| 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..|
+| 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d|
+| cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu|
+| f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U|
+| 19 8d 7d b8 fc 26 ea 93 |..}..&.. |
+key expansion[104]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..|
+| 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..|
+| 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d|
+| cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu|
+| f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U|
+| 19 8d 7d b8 fc 26 ea 93 |..}..&.. |
+Client MAC key[20]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 |.... |
+Server MAC key[20]:
+| 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 6f f9 19 0d |<.X..r.'N_..o...|
+| 3a 8e 97 5b |:..[ |
+Client Write key[16]:
+| 5d 6a 9f 0f e2 2f d3 10 07 21 fe 5c 30 86 8d 05 |]j.../...!.\0...|
+Server Write key[16]:
+| 82 f6 10 4e 8c ba 3a 64 cd 78 2e 52 5b a6 ed 51 |...N..:d.x.R[..Q|
+Client Write IV[16]:
+| c0 fb f6 0b 25 aa 6e 75 f1 fe a7 c2 26 39 b2 9d |....%.nu....&9..|
+Server Write IV[16]:
+| 8c 04 da 95 a6 53 c4 55 19 8d 7d b8 fc 26 ea 93 |.....S.U..}..&..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #563 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88e...
+looking for RSA pre-master4104c46d44bde4db0259182c556118f4cc0c5e9c77bccce0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..|
+| 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....|
+| 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 25 87 db 66 ce 4f af b1 e8 4f 7d a8 a9 66 d5 |'%..f.O...O}..f.|
+| 42 14 31 0f 64 4e cf ec d2 18 38 7e b1 52 34 bf |B.1.dN....8~.R4.|
+| 27 0d 31 84 a1 0d fb a3 73 43 ad 12 f1 15 c7 08 |'.1.....sC......|
+| e3 e7 46 e8 8e ff 05 15 a4 37 35 7f bc |..F......75.. |
+hash out[104]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.|
+| f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.|
+| 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.|
+| 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..|
+| 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......|
+| c3 54 53 f2 2e 3f 8a b3 |.TS..?.. |
+PRF out[104]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.|
+| f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.|
+| 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.|
+| 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..|
+| 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......|
+| c3 54 53 f2 2e 3f 8a b3 |.TS..?.. |
+key expansion[104]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.|
+| f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.|
+| 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.|
+| 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..|
+| 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......|
+| c3 54 53 f2 2e 3f 8a b3 |.TS..?.. |
+Client MAC key[20]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c |.a.. |
+Server MAC key[20]:
+| 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 f6 8c 6f ac |0Vw.oE...hU...o.|
+| bb 31 1d ae |.1.. |
+Client Write key[16]:
+| 61 55 5f 74 03 d5 63 a8 46 6d a4 e6 d6 d8 5b d3 |aU_t..c.Fm....[.|
+Server Write key[16]:
+| c0 2e a3 39 81 2f 37 d2 20 72 ef 96 af db 8c dd |...9./7. r......|
+Client Write IV[16]:
+| f4 ca 3d 05 f8 3a 14 9c 4c 39 48 58 05 af c1 c1 |..=..:..L9HX....|
+Server Write IV[16]:
+| 2a 9e bb 97 ee 8c 85 ad c3 54 53 f2 2e 3f 8a b3 |*........TS..?..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..|
+| 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....|
+| 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 39 62 cb 33 71 c3 fd ae 15 ae 5c 2c e8 ca d3 02 |9b.3q.....\,....|
+| 57 0f 8b df e0 42 e8 cd 70 58 5a ef ee d1 06 2d |W....B..pXZ....-|
+| 8b cd c9 07 cd c7 a6 39 a5 6c b4 e9 70 24 18 26 |.......9.l..p$.&|
+| ea 8d a0 39 d7 30 82 bc e2 db e1 db 94 da 97 80 |...9.0..........|
+Plaintext[64]:
+| 50 1f 07 fa 0d 0b 39 a0 0a 64 7e 64 e9 3b aa 4c |P.....9..d~d.;.L|
+| 14 00 00 0c 12 9d d4 f8 27 09 99 d2 72 a8 cf 85 |........'...r...|
+| 3e 05 25 db bf 0c 15 aa 2a 40 95 31 9c ac 60 e3 |>.%.....*@.1..`.|
+| 12 34 55 3c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.4U<............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e 05 25 db bf 0c 15 aa 2a 40 95 31 9c ac 60 e3 |>.%.....*@.1..`.|
+| 12 34 55 3c |.4U< |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #564 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 9a 82 e6 8c aa 36 3d 97 51 bd 1e 2d 4b f8 c0 1c |.....6=.Q..-K...|
+| 1f 60 86 a2 f9 d7 64 f4 3a 25 34 37 6d 7c df 4b |.`....d.:%47m|.K|
+| 7c c8 15 01 cd 92 ab fe 59 f6 89 a5 6b 7d 50 e5 ||.......Y...k}P.|
+| cb d7 d5 67 98 10 29 65 d5 f1 e4 ec 25 2b 19 0e |...g..)e....%+..|
+Plaintext[64]:
+| 61 a9 fb c3 d4 5c 11 af 0a 1e 47 f0 12 6a b7 04 |a....\....G..j..|
+| 14 00 00 0c 3a ce 0c 81 41 3f 76 af 1a 98 59 48 |....:...A?v...YH|
+| db 3b f3 3c 74 82 bc 2f f9 94 48 87 11 14 c7 83 |.;.<t../..H.....|
+| 41 f0 15 95 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |A...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| db 3b f3 3c 74 82 bc 2f f9 94 48 87 11 14 c7 83 |.;.<t../..H.....|
+| 41 f0 15 95 |A... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #565 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 11 c7 19 72 8d af cc dc e1 a9 e8 d0 89 e0 e6 5b |...r...........[|
+| 65 00 22 1a 1f 47 ae 51 7e 0c 9e cb 18 26 08 fe |e."..G.Q~....&..|
+| ff d1 b4 48 a5 13 15 56 cd ab 0b b3 72 18 44 41 |...H...V....r.DA|
+| 00 84 a8 5c 84 01 88 35 a7 ed 98 2a f0 96 bc 58 |...\...5...*...X|
+| 36 91 78 5b 96 38 b5 f7 43 85 4a ce d4 32 89 e8 |6.x[.8..C.J..2..|
+| 07 48 c3 0e e8 c2 82 d4 b1 79 5e ff dd c9 3b 08 |.H.......y^...;.|
+| 29 2d 7a 85 a5 b1 3d 1b 3c da 65 92 cd 8c a9 e9 |)-z...=.<.e.....|
+Plaintext[112]:
+| c1 a5 4c 29 3c c1 9b 56 4d 73 25 2e 16 0b 1c 0f |..L)<..VMs%.....|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 33 0d 0a 0d 0a e9 dc ed 7b 35 3e |l:4493.......{5>|
+| 80 1d df 49 f7 b7 b9 b4 51 76 27 8b c1 32 01 01 |...I....Qv'..2..|
+ssl_decrypt_record found padding 1 final len 110
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a6 f1 8a eb 0c b2 be 05 01 61 51 20 07 fb d6 e5 |.........aQ ....|
+| 04 b9 f4 43 |...C |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55294 found (nil)
+association_find: TCP port 4493 found 0x3431960
+
+dissect_ssl enter frame #566 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 0c 1a ed 62 67 7c d3 bf 24 2c b8 62 2e 87 c9 14 |...bg|..$,.b....|
+| 11 d7 0d a5 a4 06 0a 81 41 4d d8 8b 1b 32 f5 df |........AM...2..|
+| 5d 96 be 73 c1 44 c0 9e da c5 00 f5 7a 40 d7 9e |]..s.D......z@..|
+| f4 e0 e6 94 59 a2 2f 9c 17 80 53 aa 47 e0 ed bc |....Y./...S.G...|
+| c8 19 69 ac 89 b8 7f 76 de a9 15 f4 e2 ec f0 18 |..i....v........|
+| e8 75 d1 1d d6 78 90 4a 5b 0a 90 55 b1 ac ce 01 |.u...x.J[..U....|
+| 63 a2 b2 ec 72 f3 cc 2a b0 a2 86 14 20 27 6c 6d |c...r..*.... 'lm|
+| d3 8a 2b 20 92 6e a4 f8 0d 3d e9 74 2f b3 ca d4 |..+ .n...=.t/...|
+| 12 c9 58 99 dc 48 46 3e a7 2a d8 09 2e be 25 e8 |..X..HF>.*....%.|
+| ae 8d ad a7 8b 54 b9 2f 3e c8 29 19 6c 91 e9 25 |.....T./>.).l..%|
+| d9 95 43 9f 12 66 15 88 11 c9 93 fa bf c2 0e fa |..C..f..........|
+| 8a b4 d1 41 7f 77 17 da 3b a0 fe c0 f2 9e 8b 90 |...A.w..;.......|
+| be 3c c8 92 07 87 1c 3e fb 4f c0 07 be 04 22 35 |.<.....>.O...."5|
+| 63 a5 e4 9e 2b f5 d7 d8 de 0e e2 f0 c2 6b 25 e4 |c...+........k%.|
+| 73 87 41 f1 26 96 3d 09 e9 0d 27 89 4a a3 ec e9 |s.A.&.=...'.J...|
+| c2 75 94 35 bb 6b 59 37 6b b9 30 f8 91 c5 e4 fc |.u.5.kY7k.0.....|
+| 3e 90 8b 16 d9 96 7d cc f8 c2 ef a6 d4 86 86 d0 |>.....}.........|
+| 12 b0 9a 4f 46 d7 73 7d 40 ff 65 c9 37 e6 f0 a3 |...OF.s}@.e.7...|
+| 62 66 ab 6d 54 8a a9 a0 26 b4 cf 22 a3 68 04 b2 |bf.mT...&..".h..|
+| c2 aa 01 5e d5 b0 32 78 9f 97 6b bb 82 8b 25 46 |...^..2x..k...%F|
+| 6b 7d 9c 5e d8 99 0f e7 07 a7 44 aa 6f 32 57 00 |k}.^......D.o2W.|
+| f6 a4 4c cc ea bc 33 96 94 d8 77 8c 8b f3 45 fa |..L...3...w...E.|
+| fc 4a f2 2c 75 05 c2 55 25 3a 1b 7b 3b aa e0 1b |.J.,u..U%:.{;...|
+| 8f d7 5e 91 1c da 0f 25 6d 05 8d b3 cf e1 54 e1 |..^....%m.....T.|
+| 68 0f 5e 1d b1 18 c5 47 44 b1 e2 24 53 c9 d5 04 |h.^....GD..$S...|
+Plaintext[400]:
+| 7d 51 f2 64 a1 0c f4 c8 11 5a 58 94 04 fa d4 a3 |}Q.d.....ZX.....|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 12 90 f4 48 |nl'</script>...H|
+| 96 c2 91 2e c1 9d ad 32 d6 bd 70 12 c7 13 00 7f |.......2..p.....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 71 53 c7 1f 72 64 3d ba a1 32 da 30 ba 36 07 de |qS..rd=..2.0.6..|
+| bf 85 bc e3 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4493 found 0x3431960
+
+dissect_ssl enter frame #567 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| dc cf 24 89 c6 0c 56 f9 f2 db af b4 d0 27 67 4c |..$...V......'gL|
+| c5 14 8a ab 4f bc 57 ba 76 ed fe 60 99 de cf 92 |....O.W.v..`....|
+| 82 4f a6 6d 19 57 c9 e8 80 a5 9d 43 a2 9c 27 b4 |.O.m.W.....C..'.|
+Plaintext[48]:
+| 70 49 5b ce d8 7a ce e0 09 b9 ab e7 a3 a2 ad bc |pI[..z..........|
+| 01 00 ad c1 c2 b0 a8 7e fb 3c ac 92 ca 7d 2a a7 |.......~.<...}*.|
+| f6 15 8e 50 42 ad 09 09 09 09 09 09 09 09 09 09 |...PB...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ad c1 c2 b0 a8 7e fb 3c ac 92 ca 7d 2a a7 f6 15 |.....~.<...}*...|
+| 8e 50 42 ad |.PB. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #569 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 02 e1 53 d6 bb 96 1f 4a e4 be 8d 0c 23 7b c0 9b |..S....J....#{..|
+| 35 c1 91 f9 0d 31 5c f0 0d 48 f2 ac f4 b4 4a 8a |5....1\..H....J.|
+| dc 2a 6b 8c 83 4d 85 bf 08 ab a4 ba 5b bd f2 49 |.*k..M......[..I|
+Plaintext[48]:
+| 16 a5 5d ba 7f 87 ad ca a4 c1 f6 5e 95 e5 db 76 |..]........^...v|
+| 01 00 c1 02 59 a4 a3 ee 13 07 27 f1 71 cc fa 01 |....Y.....'.q...|
+| d7 ba fc ff 77 d7 09 09 09 09 09 09 09 09 09 09 |....w...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c1 02 59 a4 a3 ee 13 07 27 f1 71 cc fa 01 d7 ba |..Y.....'.q.....|
+| fc ff 77 d7 |..w. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #574 (first time)
+ssl_session_init: initializing ptr 0x7facc38686e0 size 688
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 41513 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4494
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #576 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..|
+| 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....|
+| 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 6e 08 25 c8 74 53 58 ef 2c 57 1c be 4f ab 12 |'n.%.tSX.,W..O..|
+| 69 d0 ff 82 05 d1 7d 42 c7 c0 f3 3a c0 52 34 bf |i.....}B...:.R4.|
+| 27 1b 22 ce ab 55 97 4c 25 6d b5 76 91 27 09 ca |'."..U.L%m.v.'..|
+| 19 5a b5 77 8d b5 2b 06 2f 85 5f 08 05 |.Z.w..+./._.. |
+hash out[136]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....|
+| 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.|
+| 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.|
+| ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....|
+| a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X|
+| ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../|
+| 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_|
+| 4d 4d 61 91 1d 30 3e f9 |MMa..0>. |
+PRF out[136]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....|
+| 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.|
+| 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.|
+| ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....|
+| a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X|
+| ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../|
+| 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_|
+| 4d 4d 61 91 1d 30 3e f9 |MMa..0>. |
+key expansion[136]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....|
+| 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.|
+| 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.|
+| ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....|
+| a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X|
+| ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../|
+| 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_|
+| 4d 4d 61 91 1d 30 3e f9 |MMa..0>. |
+Client MAC key[20]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e |...> |
+Server MAC key[20]:
+| 8c bb cc 54 cc db cc 63 b7 e2 14 fe 2c b3 9b d0 |...T...c....,...|
+| 52 c8 38 1c |R.8. |
+Client Write key[32]:
+| 4a c3 ef 9f 0f 1b 58 bf 50 24 98 f3 73 84 91 7a |J.....X.P$..s..z|
+| 7c 77 1c b8 00 ae 66 fb ef 14 46 f2 15 2c e6 7a ||w....f...F..,.z|
+Server Write key[32]:
+| 0c a2 81 6d c8 e2 bb ed a6 d8 0b 48 7b 1e bc 81 |...m.......H{...|
+| 16 b1 ce b7 d2 79 ee 58 ee 74 bb fb 2b 6a b9 97 |.....y.X.t..+j..|
+Client Write IV[16]:
+| 92 52 a9 9e 18 bf 8e 2f 19 45 20 49 eb e2 e6 8b |.R...../.E I....|
+Server Write IV[16]:
+| 29 9c d3 cb 1e d8 f2 5f 4d 4d 61 91 1d 30 3e f9 |)......_MMa..0>.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #578 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778d...
+looking for RSA pre-master41046cd693c8d494ffed8f2f2cc05fcaf360a4732284d113...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf272587db66ce4fafb1e84f7da8a966d54214310f644ecfecd218387eb1 F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778db52b062f855f0805 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3d db 56 9f 9b 91 f2 53 31 b2 b8 c7 96 10 c0 b5 |=.V....S1.......|
+| 90 75 1a 69 69 40 66 61 dd 50 90 dc 83 1b 5f e6 |.u.ii@fa.P...._.|
+| 92 18 11 12 8f 1b c2 6c d9 6b 29 49 72 4b c6 03 |.......l.k)IrK..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 6e 08 25 c8 74 53 58 ef 2c 57 1c be 4f ab 12 |'n.%.tSX.,W..O..|
+| 69 d0 ff 82 05 d1 7d 42 c7 c0 f3 3a c0 52 34 bf |i.....}B...:.R4.|
+| 27 1b 22 ce ab 55 97 4c 25 6d b5 76 91 27 09 ca |'."..U.L%m.v.'..|
+| 19 5a b5 77 8d b5 2b 06 2f 85 5f 08 05 |.Z.w..+./._.. |
+hash out[136]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS|
+| f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.|
+| d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...|
+| 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<|
+| 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.|
+| ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r|
+| b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.|
+| 53 95 86 05 01 d7 72 3c |S.....r< |
+PRF out[136]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS|
+| f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.|
+| d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...|
+| 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<|
+| 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.|
+| ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r|
+| b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.|
+| 53 95 86 05 01 d7 72 3c |S.....r< |
+key expansion[136]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS|
+| f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.|
+| d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...|
+| 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<|
+| 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.|
+| ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r|
+| b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.|
+| 53 95 86 05 01 d7 72 3c |S.....r< |
+Client MAC key[20]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 |..|. |
+Server MAC key[20]:
+| 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 f0 4f c4 28 |..".......PS.O.(|
+| 58 d1 58 43 |X.XC |
+Client Write key[32]:
+| de e7 18 9c be 1c 31 bf d1 1b a1 81 f5 cb 0b 15 |......1.........|
+| 84 df cf b9 46 11 cb ca 50 90 70 e9 9e cc bd 8e |....F...P.p.....|
+Server Write key[32]:
+| bb 42 3a 51 10 6e 7a 3c 2f d2 d6 bc 99 00 e1 3e |.B:Q.nz</......>|
+| fc 4f 6e f4 33 12 55 ac ce 9e b4 01 85 6c d8 f9 |.On.3.U......l..|
+Client Write IV[16]:
+| 59 3b ae 12 2b c8 3f 72 b4 c1 47 2a f0 05 ed 57 |Y;..+.?r..G*...W|
+Server Write IV[16]:
+| f2 6a 76 10 19 17 3a eb 53 95 86 05 01 d7 72 3c |.jv...:.S.....r<|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3d db 56 9f 9b 91 f2 53 31 b2 b8 c7 96 10 c0 b5 |=.V....S1.......|
+| 90 75 1a 69 69 40 66 61 dd 50 90 dc 83 1b 5f e6 |.u.ii@fa.P...._.|
+| 92 18 11 12 8f 1b c2 6c d9 6b 29 49 72 4b c6 03 |.......l.k)IrK..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b2 e5 ce a9 70 28 1f c8 ff f9 56 00 45 39 6f 6d |....p(....V.E9om|
+| 26 86 a8 8d 5e 07 99 e0 03 8a 8a 46 c9 a0 82 9f |&...^......F....|
+| 09 a3 48 3a d9 9c 22 19 a3 e9 0a 0d 15 1c 0a a3 |..H:..".........|
+| 95 78 94 83 67 93 8c da 1b 7b 93 55 7b b8 d4 d4 |.x..g....{.U{...|
+Plaintext[64]:
+| b6 87 6e bc 4b 76 09 de a7 71 2a d5 eb 57 58 ff |..n.Kv...q*..WX.|
+| 14 00 00 0c d4 31 1c 85 5d dc 59 d9 c7 1a c8 34 |.....1..].Y....4|
+| 0a 7d 21 5e b2 68 a9 40 d7 78 bd 52 13 7b 48 e4 |.}!^.h.@.x.R.{H.|
+| ce 1f a1 f4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0a 7d 21 5e b2 68 a9 40 d7 78 bd 52 13 7b 48 e4 |.}!^.h.@.x.R.{H.|
+| ce 1f a1 f4 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #579 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 2a 19 9a 9d 49 71 4a cb a6 84 97 ca 5a ff e2 d8 |*...IqJ.....Z...|
+| f9 42 ec 97 55 20 1f 54 ad e2 9d 06 5f 73 13 dc |.B..U .T...._s..|
+| 0e bc ad 1e e9 cf 4c 12 24 36 29 03 c0 b4 31 5b |......L.$6)...1[|
+| f5 7f db 78 22 2a bf f5 69 2b c4 fd a3 3f 6d 70 |...x"*..i+...?mp|
+Plaintext[64]:
+| d1 dd 68 ce 8d 2c 35 58 b0 8c df 31 fa 7e 9d 26 |..h..,5X...1.~.&|
+| 14 00 00 0c 79 c4 59 e5 00 cd 78 e3 60 c0 60 7d |....y.Y...x.`.`}|
+| b9 cc 76 a2 70 1c da 74 62 dc 98 1a e1 7b 9d 35 |..v.p..tb....{.5|
+| 3f 70 ae ec 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |?p..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b9 cc 76 a2 70 1c da 74 62 dc 98 1a e1 7b 9d 35 |..v.p..tb....{.5|
+| 3f 70 ae ec |?p.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #580 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| ca 7a 92 64 b4 c9 aa 19 0f 19 3e 97 70 aa 0b ed |.z.d......>.p...|
+| c0 2e 63 bc 3d 91 ef 86 1c 6b 80 3c 98 d2 41 03 |..c.=....k.<..A.|
+| db 04 c1 c3 eb 7f 90 0f d3 1f b2 e6 8b bc f3 d7 |................|
+| a0 3a 04 d4 8b f5 3b 01 aa 5d 46 08 3d fb 8f e0 |.:....;..]F.=...|
+| ae 47 9b fc cb 8e f8 7e cd 29 10 37 f3 49 bb a1 |.G.....~.).7.I..|
+| c0 2f 2b a6 69 3d 45 e1 b6 2d fa 62 92 5d 60 01 |./+.i=E..-.b.]`.|
+| 11 3d b8 d5 d4 a4 e1 57 37 96 4c a1 ad bf 02 60 |.=.....W7.L....`|
+Plaintext[112]:
+| 2c 40 d8 2c 17 51 aa 1a 4b 96 ba 95 a7 38 60 17 |,@.,.Q..K....8`.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 34 0d 0a 0d 0a af b4 b9 bc 7f e1 |l:4494..........|
+| dc 9a 51 8f c8 e5 87 7f 28 09 dd 18 cd ec 01 01 |..Q.....(.......|
+ssl_decrypt_record found padding 1 final len 110
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 90 e0 62 9f 41 4c 23 19 40 d8 84 6e 36 b7 4f |...b.AL#.@..n6.O|
+| 50 8e 40 af |P.@. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 41513 found (nil)
+association_find: TCP port 4494 found 0x34319f0
+
+dissect_ssl enter frame #581 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| b8 da 63 57 52 36 26 1b 47 d0 de 68 e8 b6 6c 04 |..cWR6&.G..h..l.|
+| b8 06 e8 50 28 94 5d fb b8 f4 4a 72 08 51 58 38 |...P(.]...Jr.QX8|
+| 37 1c ec 44 c2 ef 68 78 cf 1d e9 d2 d7 48 4c 79 |7..D..hx.....HLy|
+| ba d7 ee 04 4e 50 0b 24 ca b8 23 25 93 e4 bc b4 |....NP.$..#%....|
+| 8e 55 a4 39 eb e7 69 87 57 96 75 b9 de f7 52 ba |.U.9..i.W.u...R.|
+| 45 0c db 52 e0 99 44 e4 38 a9 ca 87 90 b3 1b e3 |E..R..D.8.......|
+| 45 96 79 a4 e0 b9 0a 8f ae dc 09 ed 8e 53 50 cf |E.y..........SP.|
+| c4 e2 80 57 c6 c2 44 69 5b 65 0b e9 e6 ca 02 e7 |...W..Di[e......|
+| 1f f1 42 e4 f3 19 03 2b 4f ee 24 f2 44 aa 4c 19 |..B....+O.$.D.L.|
+| 8b fd fa ed db c0 b3 af 8f 27 c8 9d a8 54 b0 19 |.........'...T..|
+| ea 94 35 d2 68 b9 90 a3 8f d5 a8 bc 9f 2b b8 4a |..5.h........+.J|
+| c3 40 c0 3b c5 aa de aa e3 11 9f d6 17 95 2a 48 |.@.;..........*H|
+| 9c 18 14 2c 4e e0 5a 0b 26 5f a5 88 d9 46 0f ef |...,N.Z.&_...F..|
+| 51 ac 5f 74 0e 63 e6 be c1 eb 95 44 c4 d2 d2 ca |Q._t.c.....D....|
+| 51 3d 27 f6 20 ef 8b 5d e5 d0 56 a4 4a 31 12 a8 |Q='. ..]..V.J1..|
+| db 94 c5 ea b1 9c 9e b4 5d f4 ef 3e b0 24 a8 0c |........]..>.$..|
+| 95 9d 51 79 87 b3 74 5e 06 ee 8a 87 87 0f 64 17 |..Qy..t^......d.|
+| f9 7b 8d df a4 0a e7 0a 07 4e d7 ce 74 df 3a 38 |.{.......N..t.:8|
+| a1 51 e3 94 ff b2 63 e0 66 ef 82 7d 87 30 46 3a |.Q....c.f..}.0F:|
+| e7 5e e9 0a fa 93 ff ae 1d f6 45 09 c6 23 06 ca |.^........E..#..|
+| 73 12 a2 6c ad c6 94 99 29 c4 cd 15 f8 6c b7 db |s..l....)....l..|
+| 87 e6 ff 07 57 55 72 9e 5d 5a db 8e 94 f6 0e 06 |....WUr.]Z......|
+| 71 9f c7 44 92 49 aa 3d 8f bc c0 e1 2a 64 2d 0b |q..D.I.=....*d-.|
+| a8 9d e8 48 1e 2e 42 36 b6 a7 74 97 2d b1 3a b5 |...H..B6..t.-.:.|
+| cf fe 5b e6 7d 72 2e 22 d5 16 25 a0 e1 2e 0e f8 |..[.}r."..%.....|
+Plaintext[400]:
+| 9c 23 65 2a 6e 85 5d b9 46 3c 12 21 7d 6e 19 2c |.#e*n.].F<.!}n.,|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 58 66 96 84 |nl'</script>Xf..|
+| d9 73 c8 a3 eb 8b 98 83 a7 72 69 2d 1f e2 11 26 |.s.......ri-...&|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6a 86 7d 10 91 da 1f 86 1f 43 33 e2 2a 04 1b f4 |j.}......C3.*...|
+| fe af 57 14 |..W. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4494 found 0x34319f0
+
+dissect_ssl enter frame #582 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 0d 9f 7c 74 f8 87 71 8e 5e 38 9a 57 a1 5b 60 41 |..|t..q.^8.W.[`A|
+| 6b ed d6 f2 79 d0 70 05 aa cc 1e 64 ef df 5a e1 |k...y.p....d..Z.|
+| c0 c6 55 70 67 03 c5 15 28 69 da 7f 25 32 1f b8 |..Upg...(i..%2..|
+Plaintext[48]:
+| 1d 5a e8 74 d0 2b 86 61 e7 5f 0e 98 f2 32 7e b2 |.Z.t.+.a._...2~.|
+| 01 00 b1 97 4c 4b 89 1e c1 dd ce e1 52 86 9e 65 |....LK......R..e|
+| fb 50 9f 1a cb 62 09 09 09 09 09 09 09 09 09 09 |.P...b..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b1 97 4c 4b 89 1e c1 dd ce e1 52 86 9e 65 fb 50 |..LK......R..e.P|
+| 9f 1a cb 62 |...b |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #584 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ff 13 52 38 01 4f 68 66 3c 33 42 cf 61 f0 65 5e |..R8.Ohf<3B.a.e^|
+| 6e a5 b3 0b e5 01 d3 66 b0 ef e0 3e 5a da 8e 8c |n......f...>Z...|
+| d5 19 c6 95 eb 2f 15 1e 5d aa 0b 72 4f 96 a4 a3 |...../..]..rO...|
+Plaintext[48]:
+| 42 5e 49 b1 26 1f 4f a1 0e 6e 12 8b 1c 74 64 f6 |B^I.&.O..n...td.|
+| 01 00 80 22 ef 86 b1 fa 0b 63 8e bf 56 65 22 c9 |...".....c..Ve".|
+| 25 c3 1e 5e 60 df 09 09 09 09 09 09 09 09 09 09 |%..^`...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 80 22 ef 86 b1 fa 0b 63 8e bf 56 65 22 c9 25 c3 |.".....c..Ve".%.|
+| 1e 5e 60 df |.^`. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #4 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+
+dissect_ssl enter frame #6 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #128 (already visited)
+ conversation = 0x7facef9977c0, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 40165 found (nil)
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #11 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #12 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+
+dissect_ssl enter frame #14 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
diff --git a/tls/all/dump.pcapng b/tls/all/dump.pcapng
new file mode 100644
index 0000000..f3cb271
--- /dev/null
+++ b/tls/all/dump.pcapng
Binary files differ
diff --git a/tls/all/premaster.txt b/tls/all/premaster.txt
new file mode 100644
index 0000000..c904d3f
--- /dev/null
+++ b/tls/all/premaster.txt
@@ -0,0 +1,78 @@
+CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+CLIENT_RANDOM 5234bf272587db66ce4fafb1e84f7da8a966d54214310f644ecfecd218387eb1 F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778db52b062f855f0805 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603
+CLIENT_RANDOM 5234bf276e0825c8745358ef2c571cbe4fab1269d0ff8205d17d42c7c0f33ac0 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603
diff --git a/tls/all/tls-urls.txt b/tls/all/tls-urls.txt
new file mode 100644
index 0000000..0e1702f
--- /dev/null
+++ b/tls/all/tls-urls.txt
@@ -0,0 +1,39 @@
+https://exp-rc4-md5.local.al.lekensteyn.nl:4434
+https://rc4-md5.local.al.lekensteyn.nl:4435
+https://rc4-sha.local.al.lekensteyn.nl:4436
+https://exp-rc2-cbc-md5.local.al.lekensteyn.nl:4437
+https://idea-cbc-sha.local.al.lekensteyn.nl:4438
+https://exp-des-cbc-sha.local.al.lekensteyn.nl:4439
+https://des-cbc-sha.local.al.lekensteyn.nl:4440
+https://des-cbc3-sha.local.al.lekensteyn.nl:4441
+https://edh-dss-des-cbc-sha.local.al.lekensteyn.nl:4443
+https://edh-dss-des-cbc3-sha.local.al.lekensteyn.nl:4444
+https://edh-rsa-des-cbc-sha.local.al.lekensteyn.nl:4446
+https://edh-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4447
+https://aes128-sha.local.al.lekensteyn.nl:4448
+https://dhe-dss-aes128-sha.local.al.lekensteyn.nl:4449
+https://dhe-rsa-aes128-sha.local.al.lekensteyn.nl:4450
+https://aes256-sha.local.al.lekensteyn.nl:4451
+https://dhe-dss-aes256-sha.local.al.lekensteyn.nl:4452
+https://dhe-rsa-aes256-sha.local.al.lekensteyn.nl:4453
+https://camellia128-sha.local.al.lekensteyn.nl:4457
+https://dhe-dss-camellia128-sha.local.al.lekensteyn.nl:4458
+https://dhe-rsa-camellia128-sha.local.al.lekensteyn.nl:4459
+https://camellia256-sha.local.al.lekensteyn.nl:4463
+https://dhe-dss-camellia256-sha.local.al.lekensteyn.nl:4464
+https://dhe-rsa-camellia256-sha.local.al.lekensteyn.nl:4465
+https://seed-sha.local.al.lekensteyn.nl:4470
+https://dhe-dss-seed-sha.local.al.lekensteyn.nl:4471
+https://dhe-rsa-seed-sha.local.al.lekensteyn.nl:4472
+https://ecdh-ecdsa-rc4-sha.local.al.lekensteyn.nl:4479
+https://ecdh-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4480
+https://ecdh-ecdsa-aes128-sha.local.al.lekensteyn.nl:4481
+https://ecdh-ecdsa-aes256-sha.local.al.lekensteyn.nl:4482
+https://ecdhe-ecdsa-rc4-sha.local.al.lekensteyn.nl:4483
+https://ecdhe-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4484
+https://ecdhe-ecdsa-aes128-sha.local.al.lekensteyn.nl:4485
+https://ecdhe-ecdsa-aes256-sha.local.al.lekensteyn.nl:4486
+https://ecdhe-rsa-rc4-sha.local.al.lekensteyn.nl:4491
+https://ecdhe-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4492
+https://ecdhe-rsa-aes128-sha.local.al.lekensteyn.nl:4493
+https://ecdhe-rsa-aes256-sha.local.al.lekensteyn.nl:4494
diff --git a/tls/all/wireshark-broken.txt b/tls/all/wireshark-broken.txt
new file mode 100644
index 0000000..51a4904
--- /dev/null
+++ b/tls/all/wireshark-broken.txt
@@ -0,0 +1,33 @@
+https://exp-rc2-cbc-md5.local.al.lekensteyn.nl:4437
+https://idea-cbc-sha.local.al.lekensteyn.nl:4438
+https://exp-des-cbc-sha.local.al.lekensteyn.nl:4439
+https://des-cbc-sha.local.al.lekensteyn.nl:4440
+https://des-cbc3-sha.local.al.lekensteyn.nl:4441
+https://edh-dss-des-cbc-sha.local.al.lekensteyn.nl:4443
+https://edh-dss-des-cbc3-sha.local.al.lekensteyn.nl:4444
+https://edh-rsa-des-cbc-sha.local.al.lekensteyn.nl:4446
+https://edh-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4447
+https://aes128-sha.local.al.lekensteyn.nl:4448
+https://dhe-dss-aes128-sha.local.al.lekensteyn.nl:4449
+https://dhe-rsa-aes128-sha.local.al.lekensteyn.nl:4450
+https://aes256-sha.local.al.lekensteyn.nl:4451
+https://dhe-dss-aes256-sha.local.al.lekensteyn.nl:4452
+https://dhe-rsa-aes256-sha.local.al.lekensteyn.nl:4453
+https://camellia128-sha.local.al.lekensteyn.nl:4457
+https://dhe-dss-camellia128-sha.local.al.lekensteyn.nl:4458
+https://dhe-rsa-camellia128-sha.local.al.lekensteyn.nl:4459
+https://camellia256-sha.local.al.lekensteyn.nl:4463
+https://dhe-dss-camellia256-sha.local.al.lekensteyn.nl:4464
+https://dhe-rsa-camellia256-sha.local.al.lekensteyn.nl:4465
+https://seed-sha.local.al.lekensteyn.nl:4470
+https://dhe-dss-seed-sha.local.al.lekensteyn.nl:4471
+https://dhe-rsa-seed-sha.local.al.lekensteyn.nl:4472
+https://ecdh-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4480
+https://ecdh-ecdsa-aes128-sha.local.al.lekensteyn.nl:4481
+https://ecdh-ecdsa-aes256-sha.local.al.lekensteyn.nl:4482
+https://ecdhe-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4484
+https://ecdhe-ecdsa-aes128-sha.local.al.lekensteyn.nl:4485
+https://ecdhe-ecdsa-aes256-sha.local.al.lekensteyn.nl:4486
+https://ecdhe-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4492
+https://ecdhe-rsa-aes128-sha.local.al.lekensteyn.nl:4493
+https://ecdhe-rsa-aes256-sha.local.al.lekensteyn.nl:4494
diff --git a/tls/all/wireshark-works.txt b/tls/all/wireshark-works.txt
new file mode 100644
index 0000000..1a04450
--- /dev/null
+++ b/tls/all/wireshark-works.txt
@@ -0,0 +1,6 @@
+https://exp-rc4-md5.local.al.lekensteyn.nl:4434
+https://rc4-md5.local.al.lekensteyn.nl:4435
+https://rc4-sha.local.al.lekensteyn.nl:4436
+https://ecdh-ecdsa-rc4-sha.local.al.lekensteyn.nl:4479
+https://ecdhe-ecdsa-rc4-sha.local.al.lekensteyn.nl:4483
+https://ecdhe-rsa-rc4-sha.local.al.lekensteyn.nl:4491
diff --git a/tls/broken/debug.txt b/tls/broken/debug.txt
new file mode 100644
index 0000000..1df833f
--- /dev/null
+++ b/tls/broken/debug.txt
@@ -0,0 +1,16741 @@
+Wireshark SSL debug log
+
+
+dissect_ssl enter frame #4 (first time)
+ssl_session_init: initializing ptr 0x7fca45bc7060 size 688
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 43113 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4437
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #6 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session can't find stored session
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+found master secret in key log
+ cannot find master secret in keylog file either
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 10 22 80 71 ca 87 eb 4b b1 84 ac ec 91 eb 50 78 |.".q...K......Px|
+| 75 dd e5 f6 01 00 0e 99 cf 82 e8 17 6d 45 b6 af |u...........mE..|
+| a4 16 a6 8a 6e 54 56 10 17 ae 71 1d 7d 48 94 fa |....nTV...q.}H..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af 39 91 ec |....P.$..;.H.9..|
+| ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 52 34 c2 |...b....{)._.R4.|
+| ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 47 08 e6 |.8.&.dXI.Y...G..|
+| d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |.4.........r. |
+hash out[88]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..|
+| 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F|
+| e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...|
+| 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.|
+| 43 5a 67 91 d3 be 45 96 |CZg...E. |
+PRF out[88]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..|
+| 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F|
+| e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...|
+| 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.|
+| 43 5a 67 91 d3 be 45 96 |CZg...E. |
+key expansion[88]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..|
+| 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F|
+| e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...|
+| 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.|
+| 43 5a 67 91 d3 be 45 96 |CZg...E. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 c2 ee 38 b6 26 be |IV blockR4..8.&.|
+| 64 58 49 cc 59 84 f3 01 47 08 e6 d5 34 b0 9f d6 |dXI.Y...G...4...|
+| e5 ce aa 97 99 ae 72 06 52 34 c2 ee c1 c5 a3 50 |......r.R4.....P|
+| c9 24 cc 9b 3b 9e 48 af 39 91 ec ab b7 b8 62 bd |.$..;.H.9.....b.|
+| cd 03 92 7b 29 e6 5f a5 |...{)._. |
+hash out[16]:
+| b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.|
+PRF out[16]:
+| b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b2 d1 b1 8c e4 |..... |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...|
+| 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.|
+| 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.|
+| 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.|
+hash out[32]:
+| a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..|
+| a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..|
+PRF out[32]:
+| a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..|
+| a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 77 08 46 e8 c7 |w.F.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...|
+| 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.|
+| 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.|
+| 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.|
+hash out[32]:
+| 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....|
+| b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....|
+PRF out[32]:
+| 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....|
+| b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....|
+Client MAC key[20]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 |y... |
+Server MAC key[20]:
+| 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b 0c 2a 6c 2c |o$.`O....L...*l,|
+| c7 16 0d c7 |.... |
+Client Write key[16]:
+| a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..|
+Server Write key[16]:
+| 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....|
+Client Write IV[8]:
+| b0 73 be 7d 7d b6 27 9b |.s.}}.'. |
+Server Write IV[8]:
+| ad 51 55 fa 0c eb 2b c7 |.QU...+. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6...
+looking for RSA pre-master30a7a60a13047dcb872bf94c040e59eacf05bf8ac168b7ad...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 10 22 80 71 ca 87 eb 4b b1 84 ac ec 91 eb 50 78 |.".q...K......Px|
+| 75 dd e5 f6 01 00 0e 99 cf 82 e8 17 6d 45 b6 af |u...........mE..|
+| a4 16 a6 8a 6e 54 56 10 17 ae 71 1d 7d 48 94 fa |....nTV...q.}H..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af 39 91 ec |....P.$..;.H.9..|
+| ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 52 34 c2 |...b....{)._.R4.|
+| ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 47 08 e6 |.8.&.dXI.Y...G..|
+| d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |.4.........r. |
+hash out[88]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..|
+| 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F|
+| e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...|
+| 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.|
+| 43 5a 67 91 d3 be 45 96 |CZg...E. |
+PRF out[88]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..|
+| 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F|
+| e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...|
+| 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.|
+| 43 5a 67 91 d3 be 45 96 |CZg...E. |
+key expansion[88]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..|
+| 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F|
+| e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...|
+| 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.|
+| 43 5a 67 91 d3 be 45 96 |CZg...E. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 c2 ee 38 b6 26 be |IV blockR4..8.&.|
+| 64 58 49 cc 59 84 f3 01 47 08 e6 d5 34 b0 9f d6 |dXI.Y...G...4...|
+| e5 ce aa 97 99 ae 72 06 52 34 c2 ee c1 c5 a3 50 |......r.R4.....P|
+| c9 24 cc 9b 3b 9e 48 af 39 91 ec ab b7 b8 62 bd |.$..;.H.9.....b.|
+| cd 03 92 7b 29 e6 5f a5 |...{)._. |
+hash out[16]:
+| b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.|
+PRF out[16]:
+| b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b2 d1 b1 8c e4 |..... |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...|
+| 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.|
+| 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.|
+| 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.|
+hash out[32]:
+| a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..|
+| a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..|
+PRF out[32]:
+| a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..|
+| a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 77 08 46 e8 c7 |w.F.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...|
+| 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.|
+| 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.|
+| 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.|
+hash out[32]:
+| 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....|
+| b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....|
+PRF out[32]:
+| 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....|
+| b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....|
+Client MAC key[20]:
+| 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.|
+| 79 d7 00 e7 |y... |
+Server MAC key[20]:
+| 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b 0c 2a 6c 2c |o$.`O....L...*l,|
+| c7 16 0d c7 |.... |
+Client Write key[16]:
+| a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..|
+Server Write key[16]:
+| 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....|
+Client Write IV[8]:
+| b0 73 be 7d 7d b6 27 9b |.s.}}.'. |
+Server Write IV[8]:
+| ad 51 55 fa 0c eb 2b c7 |.QU...+. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_handshake can't generate keyring material
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 9 offset 86 length 8168366 bytes, remaining 134
+
+dissect_ssl enter frame #9 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 9 offset 186 length 12721791 bytes, remaining 234
+
+dissect_ssl enter frame #10 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 43113 found (nil)
+association_find: TCP port 4437 found 0x27eeca0
+
+dissect_ssl enter frame #11 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 4437 found 0x27eeca0
+
+dissect_ssl enter frame #12 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #14 (first time)
+ conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #19 (first time)
+ssl_session_init: initializing ptr 0x7fca45bc8f50 size 688
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53191 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4438
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #21 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session can't find stored session
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+found master secret in key log
+ cannot find master secret in keylog file either
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.|
+| 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......|
+| cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee 0c c7 c1 54 0e 8c e7 b5 23 a2 e1 31 b7 54 1e |....T....#..1.T.|
+| 93 f1 7a 52 3b 4f 4a ab 3e 02 8c 7d 33 52 34 c2 |..zR;OJ.>..}3R4.|
+| ee d1 30 5b 25 3a 1e ed 99 b3 a4 1b 17 2a 37 8c |..0[%:.......*7.|
+| 35 07 3d b2 c9 c7 e7 87 24 86 27 6f e5 |5.=.....$.'o. |
+hash out[88]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..|
+| 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.|
+| 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n|
+| 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L|
+| c0 97 04 bf 12 84 6c 9d |......l. |
+PRF out[88]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..|
+| 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.|
+| 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n|
+| 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L|
+| c0 97 04 bf 12 84 6c 9d |......l. |
+key expansion[88]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..|
+| 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.|
+| 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n|
+| 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L|
+| c0 97 04 bf 12 84 6c 9d |......l. |
+Client MAC key[20]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 |_..A |
+Server MAC key[20]:
+| a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 06 7e a1 5e |.Q.:...?.;...~.^|
+| 1d 17 a7 20 |... |
+Client Write key[16]:
+| be 2c ee ac cb 66 30 e2 39 0e 4f 63 e7 fe b2 c3 |.,...f0.9.Oc....|
+Server Write key[16]:
+| 6e 4d 85 06 06 34 05 6e 90 1e 4d 70 cd 5d d1 47 |nM...4.n..Mp.].G|
+Client Write IV[8]:
+| 5e a4 65 6c 46 d6 c5 4c |^.elF..L |
+Server Write IV[8]:
+| c0 97 04 bf 12 84 6c 9d |......l. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #23 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9...
+looking for RSA pre-master52f8202b517f99057c766288a8a758a0459e87d4f295bf1b...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.|
+| 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......|
+| cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee 0c c7 c1 54 0e 8c e7 b5 23 a2 e1 31 b7 54 1e |....T....#..1.T.|
+| 93 f1 7a 52 3b 4f 4a ab 3e 02 8c 7d 33 52 34 c2 |..zR;OJ.>..}3R4.|
+| ee d1 30 5b 25 3a 1e ed 99 b3 a4 1b 17 2a 37 8c |..0[%:.......*7.|
+| 35 07 3d b2 c9 c7 e7 87 24 86 27 6f e5 |5.=.....$.'o. |
+hash out[88]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..|
+| 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.|
+| 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n|
+| 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L|
+| c0 97 04 bf 12 84 6c 9d |......l. |
+PRF out[88]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..|
+| 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.|
+| 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n|
+| 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L|
+| c0 97 04 bf 12 84 6c 9d |......l. |
+key expansion[88]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..|
+| 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.|
+| 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n|
+| 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L|
+| c0 97 04 bf 12 84 6c 9d |......l. |
+Client MAC key[20]:
+| 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\|
+| 5f fb fc 41 |_..A |
+Server MAC key[20]:
+| a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 06 7e a1 5e |.Q.:...?.;...~.^|
+| 1d 17 a7 20 |... |
+Client Write key[16]:
+| be 2c ee ac cb 66 30 e2 39 0e 4f 63 e7 fe b2 c3 |.,...f0.9.Oc....|
+Server Write key[16]:
+| 6e 4d 85 06 06 34 05 6e 90 1e 4d 70 cd 5d d1 47 |nM...4.n..Mp.].G|
+Client Write IV[8]:
+| 5e a4 65 6c 46 d6 c5 4c |^.elF..L |
+Server Write IV[8]:
+| c0 97 04 bf 12 84 6c 9d |......l. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.|
+| 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......|
+| cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 8b 94 d6 88 39 f0 c5 50 f8 b7 72 3f a9 48 43 21 |....9..P..r?.HC!|
+| c1 13 60 f3 1f 2a 55 5b 23 18 e7 f3 13 c6 96 ac |..`..*U[#.......|
+| 42 cc f9 44 49 15 40 7b b9 0b 45 5a ff 5d 3a 31 |B..DI.@{..EZ.]:1|
+ssl_decrypt_record: allocating 80 bytes for decrypt data (old len 32)
+Plaintext[48]:
+| 89 cc 8f 2d ad c5 e3 cb 14 00 00 0c 73 d9 ee 6d |...-........s..m|
+| f6 70 12 03 26 63 19 82 54 12 36 dd 9a 01 28 6f |.p..&c..T.6...(o|
+| 8b d9 e3 f1 c8 77 e5 f4 7c a0 8e 4c 03 03 03 03 |.....w..|..L....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 54 12 36 dd 9a 01 28 6f 8b d9 e3 f1 c8 77 e5 f4 |T.6...(o.....w..|
+| 7c a0 8e 4c ||..L |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #24 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 5a de 0f 98 f0 44 09 c9 4a 04 53 2e cc 69 aa 69 |Z....D..J.S..i.i|
+| 8e 42 b9 84 b6 66 5e 62 27 cd 0b c9 96 03 63 c9 |.B...f^b'.....c.|
+| 9d ee 16 31 9b 0e 51 32 4f 51 fa be e5 e9 9a 88 |...1..Q2OQ......|
+Plaintext[48]:
+| 5a ea 94 c9 90 8e c2 e0 14 00 00 0c 7d 92 82 0e |Z...........}...|
+| ef 51 11 23 3c e7 5f 04 eb 11 9f 11 72 f0 72 8b |.Q.#<._.....r.r.|
+| bc ea fc ce ae 86 c6 c2 e1 5b bc 0a 03 03 03 03 |.........[......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| eb 11 9f 11 72 f0 72 8b bc ea fc ce ae 86 c6 c2 |....r.r.........|
+| e1 5b bc 0a |.[.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #25 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| db ef 11 b1 a9 cf 7e c2 67 c4 7a 56 00 25 ef f7 |......~.g.zV.%..|
+| f8 f5 1b b8 60 91 ae 0f 06 0a 3a 04 4b f4 3f d7 |....`.....:.K.?.|
+| 5d 17 bc d3 c3 93 0d f6 bf b2 1f ef ac 83 ab e2 |]...............|
+| 61 2f a4 bb 93 77 84 a8 96 73 5c 91 61 bd ae 73 |a/...w...s\.a..s|
+| 5d ab 76 00 10 dd c4 96 64 9c e0 8d 83 fb 5c 70 |].v.....d.....\p|
+| 05 d5 e7 ac 0c 43 86 04 da a0 bc 3e 02 c3 5c 37 |.....C.....>..\7|
+ssl_decrypt_record: allocating 128 bytes for decrypt data (old len 80)
+Plaintext[96]:
+| 22 48 fe 5b 33 3b 3f 62 47 45 54 20 2f 20 48 54 |"H.[3;?bGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 69 64 |TP/1.1..Host: id|
+| 65 61 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c |ea-cbc-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 33 38 0d 0a 0d 0a 50 bd d3 59 5e 6a |l:4438....P..Y^j|
+| 7f 7e 76 42 36 4c 81 b2 9b c7 5c 05 66 e8 01 01 |.~vB6L....\.f...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1f bc fd b5 97 13 b5 7e 67 5d 51 0d 63 94 b2 c0 |.......~g]Q.c...|
+| 05 92 3e 50 |..>P |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53191 found (nil)
+association_find: TCP port 4438 found 0x36f72e0
+
+dissect_ssl enter frame #26 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 7e 76 ff c1 b8 94 43 f9 c9 32 9f b7 43 e3 54 c4 |~v....C..2..C.T.|
+| 27 81 bd 50 0b b4 7e 51 70 c4 6f 99 c0 d7 b1 19 |'..P..~Qp.o.....|
+| 13 52 6c 7f b6 c4 33 cd 25 61 89 88 c4 f0 19 6c |.Rl...3.%a.....l|
+| ec 41 63 3b e7 4d 31 21 54 b0 fb 7d 8f dc 6e fc |.Ac;.M1!T..}..n.|
+| 51 ba 00 73 8f 1e 13 c6 bf af 62 c4 da ee df d6 |Q..s......b.....|
+| 81 ea a7 a1 9e 6d 81 e5 f5 46 98 7b 6a 11 8f a9 |.....m...F.{j...|
+| 69 64 36 ae 59 fd 30 3b 7e 90 97 1d f2 c6 a5 54 |id6.Y.0;~......T|
+| be fa aa 02 3c b7 b0 ba 91 c8 11 99 fc 0d c1 e8 |....<...........|
+| 21 24 e9 e5 a4 fb bf 07 4b 79 94 73 c7 6b a3 57 |!$......Ky.s.k.W|
+| 4d 4f 5f 6f aa a2 6f 6d 2e 2c e0 50 4c bf 58 51 |MO_o..om.,.PL.XQ|
+| c6 5a 68 fd 4e d2 99 51 0f 85 00 94 d2 88 11 72 |.Zh.N..Q.......r|
+| af 7e 44 d4 1a 6d 26 44 4a 6b a7 25 43 19 72 32 |.~D..m&DJk.%C.r2|
+| ff 2f 39 e7 60 32 72 36 74 18 78 db b7 04 6a c8 |./9.`2r6t.x...j.|
+| 05 0b 4d be 0a ac 04 a8 28 d4 97 b4 5d df 48 ce |..M.....(...].H.|
+| 9a c0 f7 23 68 0a d2 6c 68 b8 f4 17 c9 8b 3a 1c |...#h..lh.....:.|
+| 42 b2 f9 2b ea 66 6a 40 62 12 91 36 11 15 6c 2e |B..+.fj@b..6..l.|
+| da f2 28 c4 de 64 21 93 81 b0 ab d5 37 e6 a2 7c |..(..d!.....7..||
+| f9 32 57 46 69 71 b1 b5 8b 58 54 f8 99 26 56 68 |.2WFiq...XT..&Vh|
+| 20 d1 bc 3f a3 20 01 d2 63 fc f9 ba 1d b4 cf e0 | ..?. ..c.......|
+| 4f 70 5c a0 e1 1b 2e 82 8a 02 cc 8e a4 6d bc 0b |Op\..........m..|
+| a1 39 b3 08 b4 3e 05 a2 ea 9b 11 b4 f8 10 2a db |.9...>........*.|
+| 8a ab 94 b6 80 b5 71 6f 9f b0 a4 93 65 5d d8 47 |......qo....e].G|
+| 88 90 f2 2e fd 9d e2 f0 0b c5 7c bf 25 b2 c2 55 |..........|.%..U|
+| ad 1a 8d 81 ef 1a cb d4 f4 3d e0 f5 cd 63 e1 c2 |.........=...c..|
+ssl_decrypt_record: allocating 416 bytes for decrypt data (old len 128)
+Plaintext[384]:
+| a9 83 b0 4b bb 6f f2 f6 48 54 54 50 2f 31 2e 31 |...K.o..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 36 20 47 4d |2013 20:11:26 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 37 |che....0x00,0x07|
+| 20 2d 20 49 44 45 41 2d 43 42 43 2d 53 48 41 20 | - IDEA-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 49 44 45 41 28 31 32 |RSA Enc=IDEA(12|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 8e 6f cb 63 13 76 9b 4f eb 49 eb 6a |ipt>.o.c.v.O.I.j|
+| 2f ab f7 d7 a2 c5 cb 54 07 07 07 07 07 07 07 07 |/......T........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a5 b3 22 d9 cb ff bb 2d 13 31 8b 0d 99 ae e6 10 |.."....-.1......|
+| 4d 27 43 48 |M'CH |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4438 found 0x36f72e0
+
+dissect_ssl enter frame #27 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 58 7d 74 ba 26 4e 44 9f a6 e9 b9 f4 35 d0 3d a4 |X}t.&ND.....5.=.|
+| 08 17 ce 7f 9c 8b f1 74 16 2b a7 3a 54 88 39 64 |.......t.+.:T.9d|
+Plaintext[32]:
+| 37 2a 87 56 dc 8d ae 99 01 00 91 ca 46 c7 48 f0 |7*.V........F.H.|
+| 6c 31 2b 39 87 04 69 d8 a7 41 ca 6d 78 3d 01 01 |l1+9..i..A.mx=..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 91 ca 46 c7 48 f0 6c 31 2b 39 87 04 69 d8 a7 41 |..F.H.l1+9..i..A|
+| ca 6d 78 3d |.mx= |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #29 (first time)
+ conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e7 c0 f1 d5 5a f9 6c b2 93 d1 64 d9 1a 7f 63 e7 |....Z.l...d...c.|
+| 3e 84 b1 ad 6b e7 cc 07 8d f2 e0 67 3f c1 0a 55 |>...k......g?..U|
+Plaintext[32]:
+| 2b f5 68 b1 f5 db 20 23 01 00 7d 41 e5 42 17 fe |+.h... #..}A.B..|
+| 46 bd 0c 3c 4d e3 2f 0f fd 08 22 58 64 f5 01 01 |F..<M./..."Xd...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7d 41 e5 42 17 fe 46 bd 0c 3c 4d e3 2f 0f fd 08 |}A.B..F..<M./...|
+| 22 58 64 f5 |"Xd. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #34 (first time)
+ssl_session_init: initializing ptr 0x7fca45bcb520 size 688
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52252 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4439
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #36 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.|
+| 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......|
+| cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c c2 41 1e |.....zF.N...<.A.|
+| dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a 52 34 c2 |..+.t.R,...lZR4.|
+| ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 e7 ba f5 |........._......|
+| 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |..E4.X>...Y.. |
+hash out[72]:
+| f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>|
+| 5b 87 77 05 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 |[.w.|...z.jK.l[p|
+| 2b 5d 00 5e e4 85 4d b6 b1 ef af 37 22 b6 a8 a3 |+].^..M....7"...|
+| 79 ad c3 8a 20 f3 2b 0e 29 e6 95 c0 d7 8d 85 06 |y... .+.).......|
+| b7 0f 88 7a 70 cb 20 1b |...zp. . |
+PRF out[72]:
+| f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>|
+| 5b 87 77 05 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 |[.w.|...z.jK.l[p|
+| 2b 5d 00 5e e4 85 4d b6 b1 ef af 37 22 b6 a8 a3 |+].^..M....7"...|
+| 79 ad c3 8a 20 f3 2b 0e 29 e6 95 c0 d7 8d 85 06 |y... .+.).......|
+| b7 0f 88 7a 70 cb 20 1b |...zp. . |
+key expansion[72]:
+| f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>|
+| 5b 87 77 05 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 |[.w.|...z.jK.l[p|
+| 2b 5d 00 5e e4 85 4d b6 b1 ef af 37 22 b6 a8 a3 |+].^..M....7"...|
+| 79 ad c3 8a 20 f3 2b 0e 29 e6 95 c0 d7 8d 85 06 |y... .+.).......|
+| b7 0f 88 7a 70 cb 20 1b |...zp. . |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 c2 ee a5 c9 9d c7 |IV blockR4......|
+| f6 a2 83 8e 5f b1 9c 19 e7 ba f5 82 a5 45 34 b8 |...._........E4.|
+| 58 3e ec 8f c2 59 f2 c7 52 34 c2 ee bd c1 e5 e7 |X>...Y..R4......|
+| 7a 46 d6 4e b4 b6 05 3c c2 41 1e dc 8e 2b ba 74 |zF.N...<.A...+.t|
+| 0c 52 2c 90 0f 0e 6c 5a |.R,...lZ |
+hash out[16]:
+| 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..|
+PRF out[16]:
+| 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b1 ef af 37 22 |...7" |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...|
+| e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..|
+| 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<|
+| c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ|
+hash out[32]:
+| bb 81 e4 2d 52 b5 40 1d 87 03 cd bc 73 fb 07 b3 |...-R.@.....s...|
+| 63 8a 2f 9e 36 81 38 39 33 e4 f4 39 f2 d7 a0 f1 |c./.6.893..9....|
+PRF out[32]:
+| bb 81 e4 2d 52 b5 40 1d 87 03 cd bc 73 fb 07 b3 |...-R.@.....s...|
+| 63 8a 2f 9e 36 81 38 39 33 e4 f4 39 f2 d7 a0 f1 |c./.6.893..9....|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b6 a8 a3 79 ad |...y. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...|
+| e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..|
+| 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<|
+| c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ|
+hash out[32]:
+| 48 d8 eb 1f 78 6f 23 0e fd 7e 5b f4 43 c0 07 93 |H...xo#..~[.C...|
+| a0 cf 99 1b 8b 2c 5b df 3d 01 43 b1 8d b8 0d 1f |.....,[.=.C.....|
+PRF out[32]:
+| 48 d8 eb 1f 78 6f 23 0e fd 7e 5b f4 43 c0 07 93 |H...xo#..~[.C...|
+| a0 cf 99 1b 8b 2c 5b df 3d 01 43 b1 8d b8 0d 1f |.....,[.=.C.....|
+Client MAC key[20]:
+| f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>|
+| 5b 87 77 05 |[.w. |
+Server MAC key[20]:
+| 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 2b 5d 00 5e ||...z.jK.l[p+].^|
+| e4 85 4d b6 |..M. |
+Client Write key[8]:
+| bb 81 e4 2d 52 b5 40 1d |...-R.@. |
+Server Write key[8]:
+| 48 d8 eb 1f 78 6f 23 0e |H...xo#. |
+Client Write IV[8]:
+| 79 3b 01 46 6c 9c d2 40 |y;.Fl..@ |
+Server Write IV[8]:
+| 5a b1 9b a2 e8 58 10 ff |Z....X.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #38 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8...
+looking for RSA pre-masterb4507d09a2027556a9d42252a65b30544a40764ba079ffc6...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0b ab 27 4b 82 b7 19 b4 62 14 9d 8f cb fc 23 54 |..'K....b.....#T|
+| 42 76 2b 08 29 3b 1f f7 a3 1e 8e 12 eb e4 20 6e |Bv+.);........ n|
+| 58 52 a2 3e 32 7b de d1 83 be 8f f4 ea c0 3b e8 |XR.>2{........;.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c c2 41 1e |.....zF.N...<.A.|
+| dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a 52 34 c2 |..+.t.R,...lZR4.|
+| ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 e7 ba f5 |........._......|
+| 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |..E4.X>...Y.. |
+hash out[72]:
+| 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..|
+| 4c 8b 48 e6 cd 5d 7e bf ec a3 60 94 a1 c6 df ba |L.H..]~...`.....|
+| 11 84 c8 ba 63 fe d9 6b c8 9d fc ac a7 63 5b 26 |....c..k.....c[&|
+| fe c8 1d 98 40 bd 2c f3 55 c9 5c 12 fb 06 cf 7a |....@.,.U.\....z|
+| f9 fa 51 fd 78 fc 9a 34 |..Q.x..4 |
+PRF out[72]:
+| 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..|
+| 4c 8b 48 e6 cd 5d 7e bf ec a3 60 94 a1 c6 df ba |L.H..]~...`.....|
+| 11 84 c8 ba 63 fe d9 6b c8 9d fc ac a7 63 5b 26 |....c..k.....c[&|
+| fe c8 1d 98 40 bd 2c f3 55 c9 5c 12 fb 06 cf 7a |....@.,.U.\....z|
+| f9 fa 51 fd 78 fc 9a 34 |..Q.x..4 |
+key expansion[72]:
+| 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..|
+| 4c 8b 48 e6 cd 5d 7e bf ec a3 60 94 a1 c6 df ba |L.H..]~...`.....|
+| 11 84 c8 ba 63 fe d9 6b c8 9d fc ac a7 63 5b 26 |....c..k.....c[&|
+| fe c8 1d 98 40 bd 2c f3 55 c9 5c 12 fb 06 cf 7a |....@.,.U.\....z|
+| f9 fa 51 fd 78 fc 9a 34 |..Q.x..4 |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 c2 ee a5 c9 9d c7 |IV blockR4......|
+| f6 a2 83 8e 5f b1 9c 19 e7 ba f5 82 a5 45 34 b8 |...._........E4.|
+| 58 3e ec 8f c2 59 f2 c7 52 34 c2 ee bd c1 e5 e7 |X>...Y..R4......|
+| 7a 46 d6 4e b4 b6 05 3c c2 41 1e dc 8e 2b ba 74 |zF.N...<.A...+.t|
+| 0c 52 2c 90 0f 0e 6c 5a |.R,...lZ |
+hash out[16]:
+| 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..|
+PRF out[16]:
+| 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| c8 9d fc ac a7 |..... |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...|
+| e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..|
+| 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<|
+| c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ|
+hash out[32]:
+| 82 d1 7e ec c0 3c df 2b 85 6e 14 a4 f7 af db aa |..~..<.+.n......|
+| 49 35 c1 53 6b 9e 5f df 5c 51 57 de 96 a3 0d 3a |I5.Sk._.\QW....:|
+PRF out[32]:
+| 82 d1 7e ec c0 3c df 2b 85 6e 14 a4 f7 af db aa |..~..<.+.n......|
+| 49 35 c1 53 6b 9e 5f df 5c 51 57 de 96 a3 0d 3a |I5.Sk._.\QW....:|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 63 5b 26 fe c8 |c[&.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...|
+| e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..|
+| 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<|
+| c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ|
+hash out[32]:
+| 99 4f 65 84 43 2c a4 4e 2d ce 0e 87 db b3 ec 22 |.Oe.C,.N-......"|
+| 70 fb 21 83 18 57 f7 14 0c 00 57 a2 0b 86 1f 03 |p.!..W....W.....|
+PRF out[32]:
+| 99 4f 65 84 43 2c a4 4e 2d ce 0e 87 db b3 ec 22 |.Oe.C,.N-......"|
+| 70 fb 21 83 18 57 f7 14 0c 00 57 a2 0b 86 1f 03 |p.!..W....W.....|
+Client MAC key[20]:
+| 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..|
+| 4c 8b 48 e6 |L.H. |
+Server MAC key[20]:
+| cd 5d 7e bf ec a3 60 94 a1 c6 df ba 11 84 c8 ba |.]~...`.........|
+| 63 fe d9 6b |c..k |
+Client Write key[8]:
+| 82 d1 7e ec c0 3c df 2b |..~..<.+ |
+Server Write key[8]:
+| 99 4f 65 84 43 2c a4 4e |.Oe.C,.N |
+Client Write IV[8]:
+| 79 3b 01 46 6c 9c d2 40 |y;.Fl..@ |
+Server Write IV[8]:
+| 5a b1 9b a2 e8 58 10 ff |Z....X.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 0b ab 27 4b 82 b7 19 b4 62 14 9d 8f cb fc 23 54 |..'K....b.....#T|
+| 42 76 2b 08 29 3b 1f f7 a3 1e 8e 12 eb e4 20 6e |Bv+.);........ n|
+| 58 52 a2 3e 32 7b de d1 83 be 8f f4 ea c0 3b e8 |XR.>2{........;.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 8a 34 24 b6 26 72 34 78 a6 37 0c d2 1a 1a f4 39 |.4$.&r4x.7.....9|
+| 36 93 12 9e c0 a5 a0 53 51 c6 24 31 12 72 33 ea |6......SQ.$1.r3.|
+| 37 48 c5 0f 16 72 d6 2f ed aa 53 e3 a9 14 fb 31 |7H...r./..S....1|
+Plaintext[48]:
+| ff e5 dc bc 7b fc 34 56 14 00 00 0c fd 8d 6f e3 |....{.4V......o.|
+| 45 29 77 76 c4 01 79 22 02 ed c5 d5 fb 88 2f e9 |E)wv..y"....../.|
+| b9 e2 5d 59 89 cf 90 0e ae fe c6 05 03 03 03 03 |..]Y............|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 02 ed c5 d5 fb 88 2f e9 b9 e2 5d 59 89 cf 90 0e |....../...]Y....|
+| ae fe c6 05 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #39 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 20 11 b1 62 6b c7 fc 1c fe 89 7d 37 1c 19 b2 94 | ..bk.....}7....|
+| 25 59 02 7a 7f f4 3a e9 a2 21 83 47 60 44 cb 06 |%Y.z..:..!.G`D..|
+| 78 54 dd d9 15 51 2b 92 a1 f5 e9 fe e2 27 fc 3b |xT...Q+......'.;|
+Plaintext[48]:
+| 37 3a 3b 9c a4 dd 36 e8 14 00 00 0c 5a 79 d7 6d |7:;...6.....Zy.m|
+| 47 da 53 c8 2b 78 e2 8f 3a 80 95 81 d6 04 07 d4 |G.S.+x..:.......|
+| 5f 96 c5 47 93 21 69 a6 78 0b c6 9c 03 03 03 03 |_..G.!i.x.......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3a 80 95 81 d6 04 07 d4 5f 96 c5 47 93 21 69 a6 |:......._..G.!i.|
+| 78 0b c6 9c |x... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #40 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| c2 cf 2b bb e0 dd e6 1e 2f 74 62 58 8b ee 6d 70 |..+...../tbX..mp|
+| 0f 41 42 ba e7 80 e2 66 82 7d 51 83 49 05 5b a1 |.AB....f.}Q.I.[.|
+| 99 3c 90 26 9c ca 86 a9 cc a5 c0 18 be 94 1c d0 |.<.&............|
+| 8b 87 a0 e7 4d 36 2c 04 75 7e 86 e3 3f ff 1b 98 |....M6,.u~..?...|
+| 5c 48 48 56 5a 2c 21 72 a4 3b 8d df c5 90 db 66 |\HHVZ,!r.;.....f|
+| a8 b8 3f a1 a9 75 43 78 7f 77 7a 98 ad 63 58 82 |..?..uCx.wz..cX.|
+| 00 3e 2a c2 46 b1 6b 6f |.>*.F.ko |
+Plaintext[104]:
+| 68 9c bf 22 a5 d6 dc 95 47 45 54 20 2f 20 48 54 |h.."....GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 78 |TP/1.1..Host: ex|
+| 70 2d 64 65 73 2d 63 62 63 2d 73 68 61 2e 6c 6f |p-des-cbc-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 39 0d 0a 0d 0a 95 af b9 |n.nl:4439.......|
+| 4a 3d 66 64 a8 ba b2 44 a1 71 72 2d 7a 6a 8d 41 |J=fd...D.qr-zj.A|
+| 24 06 06 06 06 06 06 06 |$....... |
+ssl_decrypt_record found padding 6 final len 97
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 91 fd 74 1d 69 ab a3 35 10 76 37 1e bb 5e 0f a2 |..t.i..5.v7..^..|
+| 8c 63 8b 45 |.c.E |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52252 found (nil)
+association_find: TCP port 4439 found 0x372c770
+
+dissect_ssl enter frame #41 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 81 93 99 db 17 03 1d 65 97 3f 18 6d fb 6f 90 42 |.......e.?.m.o.B|
+| 60 43 50 a6 82 24 9d 9e 65 d5 a2 ca 01 09 c4 ac |`CP..$..e.......|
+| dc 7b df 16 e6 c9 9d a0 7f fa e5 ef 35 53 34 0b |.{..........5S4.|
+| 96 b1 df b3 24 5b ec 66 8c 9e d3 60 e3 c8 c2 e2 |....$[.f...`....|
+| 15 d7 8d 74 75 3c 77 5d 00 70 8e fc 0e d2 d0 d7 |...tu<w].p......|
+| 44 d0 bb 6c 5d 48 e8 04 74 f9 e6 46 20 25 f6 d3 |D..l]H..t..F %..|
+| ad 21 c3 6a c0 f6 37 1c 69 5d 9c 6e b0 c6 02 be |.!.j..7.i].n....|
+| cd e0 b5 c6 d3 b4 be c2 7c 44 e0 63 b8 c5 34 07 |........|D.c..4.|
+| 29 79 cf 6b 08 6d 15 24 ec 82 a1 d0 90 7a 8d 07 |)y.k.m.$.....z..|
+| 17 ef a1 5a dc 1b 8c f4 3a 7a 07 75 c6 78 d3 7f |...Z....:z.u.x..|
+| 29 73 6e 42 26 36 72 c8 e5 8d 54 a9 4d 35 b1 90 |)snB&6r...T.M5..|
+| 53 e1 7d 5b 4b 53 bc b4 69 f0 cb 79 d0 fd df 3d |S.}[KS..i..y...=|
+| 2a 6d a0 d9 90 5a d5 85 f8 81 10 0e 6b 4c f8 81 |*m...Z......kL..|
+| c1 95 70 32 98 9d 20 3a 5a 55 31 b8 6e 12 57 70 |..p2.. :ZU1.n.Wp|
+| 50 a1 d3 43 2e 05 eb 16 43 a0 d4 33 23 cd 99 c7 |P..C....C..3#...|
+| be 52 89 af 07 fe d7 d7 06 5d 2f 9b c0 68 ae bd |.R.......]/..h..|
+| 16 a9 84 a5 0e 8f 8c 0a 0b e0 63 cd a6 e0 99 c1 |..........c.....|
+| 3d 6a 77 24 66 51 77 3d 29 7d 69 2e 6b ec ec ea |=jw$fQw=)}i.k...|
+| fd 52 2c 2e 53 94 10 13 1b 0b a4 83 13 4b 6c 43 |.R,.S........KlC|
+| bc d8 df 36 57 cf 17 b5 a6 42 b4 30 a3 f5 00 26 |...6W....B.0...&|
+| 76 db e6 b9 cc e8 56 f4 12 96 58 a1 5a 0b 24 68 |v.....V...X.Z.$h|
+| bd 85 69 cd cc 7b c1 88 7c 06 c5 cd 4e fd e4 c8 |..i..{..|...N...|
+| 8c ec f8 b6 1b 96 37 07 09 12 ad a8 f8 02 5c bb |......7.......\.|
+| 54 3c 62 e4 7a 49 88 48 07 bd fe 34 9c 29 46 84 |T<b.zI.H...4.)F.|
+Plaintext[384]:
+| 2c db b6 ba 62 4f 12 a9 48 54 54 50 2f 31 2e 31 |,...bO..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 36 20 47 4d |2013 20:11:26 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 38 0d |ent-Length: 148.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 38 |che....0x00,0x08|
+| 20 2d 20 45 58 50 2d 44 45 53 2d 43 42 43 2d 53 | - EXP-DES-CBC-S|
+| 48 41 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 |HA SSLv3|
+| 20 4b 78 3d 52 53 41 28 35 31 32 29 20 41 75 3d | Kx=RSA(512) Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 34 30 29 |RSA Enc=DES(40)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 20 65 78 70 6f | Mac=SHA1 expo|
+| 72 74 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |rt<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 43 a1 ab 75 a3 |l'</script>C..u.|
+| ad 4e f7 01 0c 1c 99 0d b3 64 9f 73 b4 ec 30 00 |.N.......d.s..0.|
+ssl_decrypt_record found padding 0 final len 383
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cf 56 a9 5a ac ad 32 81 ef e3 59 14 59 15 39 1f |.V.Z..2...Y.Y.9.|
+| 20 c3 2e e9 | ... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4439 found 0x372c770
+
+dissect_ssl enter frame #42 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ef d1 1b b2 48 c0 fd 38 0c 6c f1 35 e9 a5 6f 0c |....H..8.l.5..o.|
+| 4a b2 c2 49 6a 9a f2 01 ac ee 3f 63 68 e5 a5 44 |J..Ij.....?ch..D|
+Plaintext[32]:
+| 22 2d 3d 89 53 37 73 ee 01 00 b2 a7 38 7a 54 b2 |"-=.S7s.....8zT.|
+| 25 67 f9 5b ac c5 57 ca f0 81 43 34 65 fd 01 01 |%g.[..W...C4e...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b2 a7 38 7a 54 b2 25 67 f9 5b ac c5 57 ca f0 81 |..8zT.%g.[..W...|
+| 43 34 65 fd |C4e. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #44 (first time)
+ conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 8f f5 59 27 21 66 fe 44 c8 3e 6c 7e 9c 70 5e d2 |..Y'!f.D.>l~.p^.|
+| 15 ed 39 ed 7c 90 62 b5 62 62 b3 53 9e b2 e9 74 |..9.|.b.bb.S...t|
+Plaintext[32]:
+| 9c 7b 61 50 48 f0 f8 cd 01 00 74 71 ef 35 99 df |.{aPH.....tq.5..|
+| 9d 41 a5 3c 78 1f 28 e6 d5 a5 f9 bb bc 12 01 01 |.A.<x.(.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 71 ef 35 99 df 9d 41 a5 3c 78 1f 28 e6 d5 a5 |tq.5...A.<x.(...|
+| f9 bb bc 12 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #49 (first time)
+ssl_session_init: initializing ptr 0x7fca45bcda20 size 688
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50234 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4440
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #51 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0b ab 27 4b 82 b7 19 b4 62 14 9d 8f cb fc 23 54 |..'K....b.....#T|
+| 42 76 2b 08 29 3b 1f f7 a3 1e 8e 12 eb e4 20 6e |Bv+.);........ n|
+| 58 52 a2 3e 32 7b de d1 83 be 8f f4 ea c0 3b e8 |XR.>2{........;.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee 3b ae f1 90 c5 e5 41 12 cc 6e 9a d6 a1 ea 91 |.;.....A..n.....|
+| ae 19 c3 01 fc 8c f8 e1 86 38 8b c9 fc 52 34 c2 |.........8...R4.|
+| ee 7b bc 73 08 c9 74 f0 a0 55 5b 67 6c fe e7 19 |.{.s..t..U[gl...|
+| ca 57 8a 07 46 b6 91 b4 2e fa 4e 74 52 |.W..F.....NtR |
+hash out[72]:
+| 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q|
+| 4b ef d9 f8 aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 |K....j-/....q..#|
+| 3c 85 e9 3f 3f 75 a5 95 d9 12 a7 89 73 a2 4e 73 |<..??u......s.Ns|
+| 25 68 1e 78 19 a3 b5 3b 42 99 ab 28 82 62 9e 0c |%h.x...;B..(.b..|
+| 15 a7 8d cf 5a 75 44 d9 |....ZuD. |
+PRF out[72]:
+| 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q|
+| 4b ef d9 f8 aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 |K....j-/....q..#|
+| 3c 85 e9 3f 3f 75 a5 95 d9 12 a7 89 73 a2 4e 73 |<..??u......s.Ns|
+| 25 68 1e 78 19 a3 b5 3b 42 99 ab 28 82 62 9e 0c |%h.x...;B..(.b..|
+| 15 a7 8d cf 5a 75 44 d9 |....ZuD. |
+key expansion[72]:
+| 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q|
+| 4b ef d9 f8 aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 |K....j-/....q..#|
+| 3c 85 e9 3f 3f 75 a5 95 d9 12 a7 89 73 a2 4e 73 |<..??u......s.Ns|
+| 25 68 1e 78 19 a3 b5 3b 42 99 ab 28 82 62 9e 0c |%h.x...;B..(.b..|
+| 15 a7 8d cf 5a 75 44 d9 |....ZuD. |
+Client MAC key[20]:
+| 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q|
+| 4b ef d9 f8 |K... |
+Server MAC key[20]:
+| aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 3c 85 e9 3f |.j-/....q..#<..?|
+| 3f 75 a5 95 |?u.. |
+Client Write key[8]:
+| d9 12 a7 89 73 a2 4e 73 |....s.Ns |
+Server Write key[8]:
+| 25 68 1e 78 19 a3 b5 3b |%h.x...; |
+Client Write IV[8]:
+| 42 99 ab 28 82 62 9e 0c |B..(.b.. |
+Server Write IV[8]:
+| 15 a7 8d cf 5a 75 44 d9 |....ZuD. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #53 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746...
+looking for RSA pre-master409c440a8ec260eb9793215c95c4dd11942f4b6f516c1dbb...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3d ed 66 7b 21 4e 57 7c 2a e4 22 04 43 36 c7 2a |=.f{!NW|*.".C6.*|
+| 7d 6b 4d 52 a3 a5 12 13 66 6d 2b c0 03 c9 ba c0 |}kMR....fm+.....|
+| 2a 86 4b 9c 5b 8d 34 bf 25 c9 9c dc 8c 6c d3 e1 |*.K.[.4.%....l..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ee 3b ae f1 90 c5 e5 41 12 cc 6e 9a d6 a1 ea 91 |.;.....A..n.....|
+| ae 19 c3 01 fc 8c f8 e1 86 38 8b c9 fc 52 34 c2 |.........8...R4.|
+| ee 7b bc 73 08 c9 74 f0 a0 55 5b 67 6c fe e7 19 |.{.s..t..U[gl...|
+| ca 57 8a 07 46 b6 91 b4 2e fa 4e 74 52 |.W..F.....NtR |
+hash out[72]:
+| 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....|
+| a1 38 18 90 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 |.8..\.Jt..nT0^..|
+| 71 c7 85 1c b3 d1 f0 10 90 dd cd c2 41 7a b0 bd |q...........Az..|
+| 8c b3 9f 99 2d c8 86 ea f5 9d cc 15 36 e3 2c 62 |....-.......6.,b|
+| e7 07 c8 69 b2 40 84 15 |...i.@.. |
+PRF out[72]:
+| 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....|
+| a1 38 18 90 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 |.8..\.Jt..nT0^..|
+| 71 c7 85 1c b3 d1 f0 10 90 dd cd c2 41 7a b0 bd |q...........Az..|
+| 8c b3 9f 99 2d c8 86 ea f5 9d cc 15 36 e3 2c 62 |....-.......6.,b|
+| e7 07 c8 69 b2 40 84 15 |...i.@.. |
+key expansion[72]:
+| 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....|
+| a1 38 18 90 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 |.8..\.Jt..nT0^..|
+| 71 c7 85 1c b3 d1 f0 10 90 dd cd c2 41 7a b0 bd |q...........Az..|
+| 8c b3 9f 99 2d c8 86 ea f5 9d cc 15 36 e3 2c 62 |....-.......6.,b|
+| e7 07 c8 69 b2 40 84 15 |...i.@.. |
+Client MAC key[20]:
+| 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....|
+| a1 38 18 90 |.8.. |
+Server MAC key[20]:
+| 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 71 c7 85 1c |\.Jt..nT0^..q...|
+| b3 d1 f0 10 |.... |
+Client Write key[8]:
+| 90 dd cd c2 41 7a b0 bd |....Az.. |
+Server Write key[8]:
+| 8c b3 9f 99 2d c8 86 ea |....-... |
+Client Write IV[8]:
+| f5 9d cc 15 36 e3 2c 62 |....6.,b |
+Server Write IV[8]:
+| e7 07 c8 69 b2 40 84 15 |...i.@.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3d ed 66 7b 21 4e 57 7c 2a e4 22 04 43 36 c7 2a |=.f{!NW|*.".C6.*|
+| 7d 6b 4d 52 a3 a5 12 13 66 6d 2b c0 03 c9 ba c0 |}kMR....fm+.....|
+| 2a 86 4b 9c 5b 8d 34 bf 25 c9 9c dc 8c 6c d3 e1 |*.K.[.4.%....l..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f2 8f aa dd 4d 21 f9 1c 46 8d a8 a7 df 7d a8 d1 |....M!..F....}..|
+| 3f 43 46 b2 1b b8 90 7a ed 8a fc 21 ba 93 04 9d |?CF....z...!....|
+| 3e ea 1e 08 88 af 51 3a fe d8 f0 50 e6 be fc 36 |>.....Q:...P...6|
+Plaintext[48]:
+| dc b0 f3 d5 86 56 ff 96 14 00 00 0c 94 11 fe de |.....V..........|
+| 99 a4 7e d3 a1 9c 8e d8 b8 14 c2 a5 07 89 f3 1e |..~.............|
+| 04 07 29 4d 0c 59 96 4e 0a d5 56 b2 03 03 03 03 |..)M.Y.N..V.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b8 14 c2 a5 07 89 f3 1e 04 07 29 4d 0c 59 96 4e |..........)M.Y.N|
+| 0a d5 56 b2 |..V. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #54 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ad 40 3b eb c2 0d 06 56 53 6f a1 88 b2 82 9b 62 |.@;....VSo.....b|
+| b4 76 5c 76 3e 71 af ed 0f 98 63 eb 65 02 50 f5 |.v\v>q....c.e.P.|
+| b4 0c 2f f0 d6 60 1f 34 2a 5e 48 a5 c4 d8 bd a0 |../..`.4*^H.....|
+Plaintext[48]:
+| c7 6f 51 5e a7 5e a9 73 14 00 00 0c 4a b2 fd 98 |.oQ^.^.s....J...|
+| f9 39 f3 70 a1 98 f7 90 88 d4 35 ad 70 ed d9 ab |.9.p......5.p...|
+| de 0c aa db 2b 82 d0 f6 fe a7 d8 43 03 03 03 03 |....+......C....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 d4 35 ad 70 ed d9 ab de 0c aa db 2b 82 d0 f6 |..5.p.......+...|
+| fe a7 d8 43 |...C |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #55 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 0b 8a df 47 20 ab 93 b2 94 37 ba ce 5f 78 c0 0b |...G ....7.._x..|
+| 1c b3 11 15 92 c5 bf 57 6b b9 0c da 5f 01 86 55 |.......Wk..._..U|
+| 5f a9 cf 23 18 00 0b 69 78 98 dc 00 c1 7b e5 9d |_..#...ix....{..|
+| ac fd 9f 21 ba cc 8a 58 fc 89 55 a3 c2 be 91 0d |...!...X..U.....|
+| b7 2c b5 ab c9 38 72 eb 6d d4 73 bd b4 4f cf 86 |.,...8r.m.s..O..|
+| 6c 3b a0 ac 22 96 5f 65 79 e1 83 58 95 e2 48 62 |l;.."._ey..X..Hb|
+Plaintext[96]:
+| 4b bb 61 ee a4 42 14 ab 47 45 54 20 2f 20 48 54 |K.a..B..GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 30 0d 0a 0d 0a 05 6f 16 ce f7 dc 29 |:4440.....o....)|
+| 03 c8 22 ea df f5 44 d8 93 ec 81 b8 0c 02 02 02 |.."...D.........|
+ssl_decrypt_record found padding 2 final len 93
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 24 a2 a3 33 b3 59 7f f9 68 f3 1d 6d 5d 3f 8d cb |$..3.Y..h..m]?..|
+| 44 51 5e ef |DQ^. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50234 found (nil)
+association_find: TCP port 4440 found 0x37341a0
+
+dissect_ssl enter frame #56 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 44 bc 94 6f 1f ec c6 12 b3 7f 4a 9c 0e 76 93 c3 |D..o......J..v..|
+| ac bd bc c4 0e 1e a6 e1 58 b6 09 87 2e f5 d7 5b |........X......[|
+| 7f 1d b2 c0 89 4c 14 8a 1d 83 8d 79 db f6 f5 f5 |.....L.....y....|
+| 12 9d a2 e2 05 5f b7 06 d0 77 da 31 e5 a0 02 3a |....._...w.1...:|
+| 48 e5 ae 49 5e d6 84 59 3a 72 f4 8f a6 17 48 17 |H..I^..Y:r....H.|
+| 50 be 77 a1 12 b8 41 e1 c9 c4 f8 ca 99 62 54 b2 |P.w...A......bT.|
+| da 76 48 34 83 81 15 eb af 54 e9 a4 11 f3 1e 79 |.vH4.....T.....y|
+| 43 5c fd d4 b8 11 ff dd 19 5c 82 b9 c2 6c e1 00 |C\.......\...l..|
+| 8c 54 9d 24 20 d7 bc b7 a7 d2 2c ab 37 cd 2a 29 |.T.$ .....,.7.*)|
+| c0 8d 7c 84 30 d0 ba 63 bb c2 a1 a4 4a 7e 86 8c |..|.0..c....J~..|
+| 1a 48 30 cd c3 8b 92 c1 de 5c 21 d5 23 f6 1e 04 |.H0......\!.#...|
+| 59 b6 a1 62 53 c4 8b b5 09 f8 eb 79 8f 48 89 34 |Y..bS......y.H.4|
+| 3d a0 f2 7f ca 91 6d e2 07 ef 80 77 8d 43 d6 9e |=.....m....w.C..|
+| fe 15 c5 9c 73 f6 0a ab ad a5 01 a5 bf d7 2e 7b |....s..........{|
+| 29 1a 07 e1 3a 98 e1 7e 66 54 66 99 55 97 62 3b |)...:..~fTf.U.b;|
+| f9 b8 c7 2a bb fe a1 41 f9 e1 89 50 d2 a6 e5 91 |...*...A...P....|
+| af 8c 21 ed 8d ca 5a 24 91 be b0 69 0b 17 e0 22 |..!...Z$...i..."|
+| 33 19 c9 38 e8 81 48 bf 6c 5b 61 64 95 41 67 02 |3..8..H.l[ad.Ag.|
+| 1f 8e fc 08 8e a1 6c f8 5e e9 bd 20 12 da e0 7a |......l.^.. ...z|
+| aa ab 23 37 1d df 08 28 51 90 26 a2 f2 f0 c1 5c |..#7...(Q.&....\|
+| cc e8 9b 57 8d 9d e2 48 5a b0 af 89 ee 33 47 fc |...W...HZ....3G.|
+| 9e 35 eb 22 70 ef 58 50 1f 68 48 e8 71 4c 80 1d |.5."p.XP.hH.qL..|
+| 9f e9 e1 69 0b 91 40 d8 84 c6 dd f4 7d e5 a3 b9 |...i..@.....}...|
+| c1 95 bd 49 e6 66 b0 9a f8 14 1b d4 bd 96 72 ba |...I.f........r.|
+Plaintext[384]:
+| b9 09 91 8c ed ea b7 30 48 54 54 50 2f 31 2e 31 |.......0HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 36 20 47 4d |2013 20:11:26 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 39 |che....0x00,0x09|
+| 20 2d 20 44 45 53 2d 43 42 43 2d 53 48 41 20 20 | - DES-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 52 4f e7 1a 63 e7 ef de db ef 98 14 |ipt>RO..c.......|
+| f3 49 2e 6d 0b f3 6e 74 07 07 07 07 07 07 07 07 |.I.m..nt........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 96 ed ff 98 e8 02 f0 e3 84 77 5f 37 a9 ed c0 |..........w_7...|
+| 17 98 88 43 |...C |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4440 found 0x37341a0
+
+dissect_ssl enter frame #57 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 76 25 57 b4 fd d5 53 79 3a 91 5b 42 aa 63 b0 82 |v%W...Sy:.[B.c..|
+| 3f 51 fd 71 ab f0 4f 69 8b e0 58 2c 9b 5f 33 37 |?Q.q..Oi..X,._37|
+Plaintext[32]:
+| 56 29 84 a4 9f 78 a8 61 01 00 90 1f 04 bb 6a 24 |V)...x.a......j$|
+| 52 81 e5 43 bc d3 f4 c0 b7 a3 b9 56 8a b6 01 01 |R..C.......V....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 90 1f 04 bb 6a 24 52 81 e5 43 bc d3 f4 c0 b7 a3 |....j$R..C......|
+| b9 56 8a b6 |.V.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #59 (first time)
+ conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 9d 19 a5 17 27 12 e6 1f f1 59 fc 12 b4 0c d0 ae |....'....Y......|
+| 77 7d 94 e4 c7 90 ce 12 28 ef 9e 3a 21 c0 67 cd |w}......(..:!.g.|
+Plaintext[32]:
+| 9a 46 f6 8d 57 a9 21 e3 01 00 25 12 ed ac 68 f0 |.F..W.!...%...h.|
+| 7c bb d8 9e 89 e2 a7 fa bd 43 d6 65 00 fa 01 01 ||........C.e....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 12 ed ac 68 f0 7c bb d8 9e 89 e2 a7 fa bd 43 |%...h.|........C|
+| d6 65 00 fa |.e.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #64 (first time)
+ssl_session_init: initializing ptr 0x7fca45bcffe0 size 688
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55842 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4441
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #66 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3d ed 66 7b 21 4e 57 7c 2a e4 22 04 43 36 c7 2a |=.f{!NW|*.".C6.*|
+| 7d 6b 4d 52 a3 a5 12 13 66 6d 2b c0 03 c9 ba c0 |}kMR....fm+.....|
+| 2a 86 4b 9c 5b 8d 34 bf 25 c9 9c dc 8c 6c d3 e1 |*.K.[.4.%....l..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef a0 b5 d9 19 5b 2c d5 9e 83 2b 61 8c 82 1a 47 |.....[,...+a...G|
+| e9 13 2e 3d 55 99 7c ed 6a c9 b3 8b 06 52 34 c2 |...=U.|.j....R4.|
+| ef fa 63 d2 3c e8 89 86 60 14 9d 57 8f 6d 08 f0 |..c.<...`..W.m..|
+| 8c 9e d6 02 2e d3 25 52 34 e3 cb eb 5d |......%R4...] |
+hash out[104]:
+| 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....|
+| 98 78 22 91 f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c |.x"..ZG..KV-...L|
+| c9 7f 2f 89 5b e6 1f 50 0a b3 55 5b 91 8f 31 8f |../.[..P..U[..1.|
+| 16 af d3 27 8b 86 ad 24 18 fe 8c a8 95 23 32 fb |...'...$.....#2.|
+| 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.|
+| b6 2f 44 f0 59 e5 3a 06 2d 14 61 fb 58 2d 05 e4 |./D.Y.:.-.a.X-..|
+| 7c fa 24 df 38 7b b4 d7 ||.$.8{.. |
+PRF out[104]:
+| 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....|
+| 98 78 22 91 f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c |.x"..ZG..KV-...L|
+| c9 7f 2f 89 5b e6 1f 50 0a b3 55 5b 91 8f 31 8f |../.[..P..U[..1.|
+| 16 af d3 27 8b 86 ad 24 18 fe 8c a8 95 23 32 fb |...'...$.....#2.|
+| 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.|
+| b6 2f 44 f0 59 e5 3a 06 2d 14 61 fb 58 2d 05 e4 |./D.Y.:.-.a.X-..|
+| 7c fa 24 df 38 7b b4 d7 ||.$.8{.. |
+key expansion[104]:
+| 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....|
+| 98 78 22 91 f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c |.x"..ZG..KV-...L|
+| c9 7f 2f 89 5b e6 1f 50 0a b3 55 5b 91 8f 31 8f |../.[..P..U[..1.|
+| 16 af d3 27 8b 86 ad 24 18 fe 8c a8 95 23 32 fb |...'...$.....#2.|
+| 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.|
+| b6 2f 44 f0 59 e5 3a 06 2d 14 61 fb 58 2d 05 e4 |./D.Y.:.-.a.X-..|
+| 7c fa 24 df 38 7b b4 d7 ||.$.8{.. |
+Client MAC key[20]:
+| 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....|
+| 98 78 22 91 |.x". |
+Server MAC key[20]:
+| f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c c9 7f 2f 89 |.ZG..KV-...L../.|
+| 5b e6 1f 50 |[..P |
+Client Write key[24]:
+| 0a b3 55 5b 91 8f 31 8f 16 af d3 27 8b 86 ad 24 |..U[..1....'...$|
+| 18 fe 8c a8 95 23 32 fb |.....#2. |
+Server Write key[24]:
+| 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.|
+| b6 2f 44 f0 59 e5 3a 06 |./D.Y.:. |
+Client Write IV[8]:
+| 2d 14 61 fb 58 2d 05 e4 |-.a.X-.. |
+Server Write IV[8]:
+| 7c fa 24 df 38 7b b4 d7 ||.$.8{.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #68 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022e...
+looking for RSA pre-master247cdbb43122a8540fc06d529d5e97d05022d592b848f7ef...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e5 3f 66 3b 4b 29 36 47 23 9f ea 49 1d d2 2e b9 |.?f;K)6G#..I....|
+| 89 04 6f 7c e5 34 dd 87 f5 69 b4 cc 06 d4 a7 72 |..o|.4...i.....r|
+| ef 94 72 fd 34 9c fc 2c f9 41 55 f7 a8 58 79 75 |..r.4..,.AU..Xyu|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef a0 b5 d9 19 5b 2c d5 9e 83 2b 61 8c 82 1a 47 |.....[,...+a...G|
+| e9 13 2e 3d 55 99 7c ed 6a c9 b3 8b 06 52 34 c2 |...=U.|.j....R4.|
+| ef fa 63 d2 3c e8 89 86 60 14 9d 57 8f 6d 08 f0 |..c.<...`..W.m..|
+| 8c 9e d6 02 2e d3 25 52 34 e3 cb eb 5d |......%R4...] |
+hash out[104]:
+| 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-|
+| db 0e 86 32 84 50 6f b2 4b 1f 62 73 84 af fa bb |...2.Po.K.bs....|
+| a9 df 11 ae a3 30 b7 f8 a3 43 1f 93 6a 5d 72 ec |.....0...C..j]r.|
+| 8c ae 20 5c ec 22 21 b2 28 cc d2 ec 6f fc 59 c2 |.. \."!.(...o.Y.|
+| d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.|
+| 35 6d b2 aa 4e 00 a8 1a 0e b8 d7 e6 df 66 a4 b9 |5m..N........f..|
+| c9 54 fc 42 a5 06 9a c3 |.T.B.... |
+PRF out[104]:
+| 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-|
+| db 0e 86 32 84 50 6f b2 4b 1f 62 73 84 af fa bb |...2.Po.K.bs....|
+| a9 df 11 ae a3 30 b7 f8 a3 43 1f 93 6a 5d 72 ec |.....0...C..j]r.|
+| 8c ae 20 5c ec 22 21 b2 28 cc d2 ec 6f fc 59 c2 |.. \."!.(...o.Y.|
+| d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.|
+| 35 6d b2 aa 4e 00 a8 1a 0e b8 d7 e6 df 66 a4 b9 |5m..N........f..|
+| c9 54 fc 42 a5 06 9a c3 |.T.B.... |
+key expansion[104]:
+| 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-|
+| db 0e 86 32 84 50 6f b2 4b 1f 62 73 84 af fa bb |...2.Po.K.bs....|
+| a9 df 11 ae a3 30 b7 f8 a3 43 1f 93 6a 5d 72 ec |.....0...C..j]r.|
+| 8c ae 20 5c ec 22 21 b2 28 cc d2 ec 6f fc 59 c2 |.. \."!.(...o.Y.|
+| d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.|
+| 35 6d b2 aa 4e 00 a8 1a 0e b8 d7 e6 df 66 a4 b9 |5m..N........f..|
+| c9 54 fc 42 a5 06 9a c3 |.T.B.... |
+Client MAC key[20]:
+| 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-|
+| db 0e 86 32 |...2 |
+Server MAC key[20]:
+| 84 50 6f b2 4b 1f 62 73 84 af fa bb a9 df 11 ae |.Po.K.bs........|
+| a3 30 b7 f8 |.0.. |
+Client Write key[24]:
+| a3 43 1f 93 6a 5d 72 ec 8c ae 20 5c ec 22 21 b2 |.C..j]r... \."!.|
+| 28 cc d2 ec 6f fc 59 c2 |(...o.Y. |
+Server Write key[24]:
+| d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.|
+| 35 6d b2 aa 4e 00 a8 1a |5m..N... |
+Client Write IV[8]:
+| 0e b8 d7 e6 df 66 a4 b9 |.....f.. |
+Server Write IV[8]:
+| c9 54 fc 42 a5 06 9a c3 |.T.B.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| e5 3f 66 3b 4b 29 36 47 23 9f ea 49 1d d2 2e b9 |.?f;K)6G#..I....|
+| 89 04 6f 7c e5 34 dd 87 f5 69 b4 cc 06 d4 a7 72 |..o|.4...i.....r|
+| ef 94 72 fd 34 9c fc 2c f9 41 55 f7 a8 58 79 75 |..r.4..,.AU..Xyu|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ac f9 4c 55 10 ea 1e 05 b3 50 3b 74 ac 07 97 6a |..LU.....P;t...j|
+| df 05 41 ae c8 1d 95 91 dd a1 63 0b cd 87 1c 57 |..A.......c....W|
+| 24 0c 15 16 17 96 ac 8c 8e fa dd 06 a5 44 9d 92 |$............D..|
+Plaintext[48]:
+| 68 a6 1b 9c 12 d1 74 fa 14 00 00 0c 30 0f 2f d0 |h.....t.....0./.|
+| e1 f3 f6 11 a1 f2 50 45 a2 b2 af fa f5 29 5c f5 |......PE.....)\.|
+| a2 59 8e 8e 80 fd 79 b4 47 50 f7 e3 03 03 03 03 |.Y....y.GP......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a2 b2 af fa f5 29 5c f5 a2 59 8e 8e 80 fd 79 b4 |.....)\..Y....y.|
+| 47 50 f7 e3 |GP.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #69 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3e e1 d4 f4 9b 00 9e ef 27 e4 9d 11 03 ed 82 ea |>.......'.......|
+| ac 6c b0 ea 70 05 a2 bc a8 f2 96 e1 e0 08 92 7a |.l..p..........z|
+| 5c a6 36 65 05 2d 53 d2 18 65 c3 e9 7d b0 9d 9c |\.6e.-S..e..}...|
+Plaintext[48]:
+| 9e 0b c1 84 a2 d6 72 88 14 00 00 0c ec e2 42 1c |......r.......B.|
+| 2d 14 db 7a 23 c9 38 e7 79 74 34 56 aa 61 50 d8 |-..z#.8.yt4V.aP.|
+| 46 af 7f 92 83 e1 10 d3 77 dd 08 c8 03 03 03 03 |F.......w.......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 74 34 56 aa 61 50 d8 46 af 7f 92 83 e1 10 d3 |yt4V.aP.F.......|
+| 77 dd 08 c8 |w... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #70 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 14 0c 26 ec 54 6c 3c 55 72 8f 8b 03 3b 76 f7 4a |..&.Tl<Ur...;v.J|
+| 55 38 50 1a 3d c3 bb f7 91 f8 12 de a6 ac b3 aa |U8P.=...........|
+| 3e 84 3d d2 12 ca 8a 2c ce 4c 64 43 e0 61 97 a6 |>.=....,.LdC.a..|
+| b7 48 c3 33 4b 0e aa bb 8e 32 01 98 5a 99 97 8a |.H.3K....2..Z...|
+| 9b 35 6b ac 7e 69 ef db 7f 3d 4b 8e 1d 59 37 50 |.5k.~i...=K..Y7P|
+| 2a 65 18 f7 0f 22 37 19 a5 f2 c4 d6 06 d5 93 ea |*e..."7.........|
+Plaintext[96]:
+| d8 f9 a4 4c 83 4d c1 4f 47 45 54 20 2f 20 48 54 |...L.M.OGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 31 0d 0a 0d 0a 04 d1 39 0a b8 49 |l:4441......9..I|
+| 51 15 a7 9f 8a 45 ea c3 e3 7d f1 5b dc 4d 01 01 |Q....E...}.[.M..|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7d 6d 73 7a f9 f0 b2 2a f8 82 bb c2 d5 4a 20 6d |}msz...*.....J m|
+| 7b dd 8d cf |{... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55842 found (nil)
+association_find: TCP port 4441 found 0x3734230
+
+dissect_ssl enter frame #71 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| be ba 44 86 33 9e 1e 79 f0 59 4b 09 1b 57 1c fc |..D.3..y.YK..W..|
+| 8a 4a fa a5 57 9d 0e 96 b5 bd 38 57 08 d4 a5 a1 |.J..W.....8W....|
+| 39 50 ef b1 98 1c 56 e6 1a 5d ea 7f 8c 65 4e 19 |9P....V..]...eN.|
+| 1b a1 e5 d6 cf 81 75 ad 2f fa 32 28 4b dc 87 00 |......u./.2(K...|
+| 9f ab 2f 5a 1d d5 11 42 85 91 72 c2 8f b9 d9 fb |../Z...B..r.....|
+| 1d f8 e8 80 6d 86 85 35 4f 84 25 2d a3 51 6d 47 |....m..5O.%-.QmG|
+| 8a 20 9c e4 1d 23 a6 cf 10 6f 76 b9 37 b1 a0 77 |. ...#...ov.7..w|
+| 19 17 92 93 be cd d4 fb 13 4f f6 df 91 27 18 1a |.........O...'..|
+| 13 3b 9b ab a3 70 1e e9 8e d5 b6 b7 43 d4 15 7c |.;...p......C..||
+| 09 2f c4 d6 18 4a 79 b4 de df 40 fc fe f2 1b bb |./...Jy...@.....|
+| fd 25 2b f1 d6 93 a6 fd 9c ff 4d cb d6 d0 d3 92 |.%+.......M.....|
+| 0b 0a 1a f5 16 17 e9 55 bb 50 9c fe a5 c9 a0 bd |.......U.P......|
+| ee 08 ee a4 7b a7 2d c4 36 07 3d 19 80 3f a5 77 |....{.-.6.=..?.w|
+| fa 29 36 88 95 a7 45 87 9a a3 8a 3a 2b b0 61 e3 |.)6...E....:+.a.|
+| 32 e0 32 8f 1a 96 44 02 f2 e9 51 43 7e 5c ff 08 |2.2...D...QC~\..|
+| b9 3b ff 53 ee 52 3f 7a 11 67 78 81 6f 5c b8 2f |.;.S.R?z.gx.o\./|
+| 7e bc f8 99 4f c1 70 60 6b 62 3f 69 23 f7 86 7a |~...O.p`kb?i#..z|
+| 0f 04 b4 15 bf cd c3 1b a6 bc 70 f2 27 be 93 21 |..........p.'..!|
+| 80 fa d7 c5 15 46 c8 76 c5 2f 3d 53 20 94 2f 38 |.....F.v./=S ./8|
+| c8 59 86 33 88 7a d7 2a 78 3a 76 f5 47 cf 51 ef |.Y.3.z.*x:v.G.Q.|
+| 9f dd 95 d7 e4 d7 aa a3 18 73 5f a0 d1 08 04 b6 |.........s_.....|
+| e0 10 3e b3 a9 21 05 06 76 ae 53 2b c2 c4 86 11 |..>..!..v.S+....|
+| ff 98 23 af 9f 46 26 00 0f c9 a5 bc 62 cb 81 b6 |..#..F&.....b...|
+| 57 73 90 09 0c b5 b6 ab 5c 23 04 08 63 cd 1a f9 |Ws......\#..c...|
+Plaintext[384]:
+| d4 a2 d7 3d c8 79 17 ba 48 54 54 50 2f 31 2e 31 |...=.y..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 41 |che....0x00,0x0A|
+| 20 2d 20 44 45 53 2d 43 42 43 33 2d 53 48 41 20 | - DES-CBC3-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 7c 2a 96 e8 2b 12 1d 20 48 e8 5b 76 |ipt>|*..+.. H.[v|
+| 0c 05 dd 50 13 e4 f3 41 07 07 07 07 07 07 07 07 |...P...A........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 36 85 33 07 1d e2 45 ac ac c1 07 4f ea da 6d 37 |6.3...E....O..m7|
+| 31 cd 88 5e |1..^ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4441 found 0x3734230
+
+dissect_ssl enter frame #72 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d9 7b 1a 88 46 f1 ce a6 66 8a c1 05 78 ef f8 e2 |.{..F...f...x...|
+| f6 d6 12 c6 e6 33 59 5f b5 ff 91 e3 d1 0a f8 e9 |.....3Y_........|
+Plaintext[32]:
+| aa 26 b7 a8 a2 00 bc 97 01 00 c9 ad a7 2f 38 14 |.&.........../8.|
+| c7 ba da c9 1c b6 06 39 56 85 21 21 42 69 01 01 |.......9V.!!Bi..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c9 ad a7 2f 38 14 c7 ba da c9 1c b6 06 39 56 85 |.../8........9V.|
+| 21 21 42 69 |!!Bi |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #74 (first time)
+ conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ef 2e e8 7e e0 ae f8 5a 54 a3 46 1f 08 8f d0 d3 |...~...ZT.F.....|
+| fd 9f ab 10 39 6a c4 24 1b d0 f6 c6 cd 1e 71 66 |....9j.$......qf|
+Plaintext[32]:
+| 47 ad 30 9f 74 e0 77 3b 01 00 69 e6 e3 83 b6 30 |G.0.t.w;..i....0|
+| 3f de 46 bf 07 02 d3 2c d0 38 3e 28 df b0 01 01 |?.F....,.8>(....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 69 e6 e3 83 b6 30 3f de 46 bf 07 02 d3 2c d0 38 |i....0?.F....,.8|
+| 3e 28 df b0 |>(.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #79 (first time)
+ssl_session_init: initializing ptr 0x7fca45bd25a0 size 688
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47560 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4443
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #81 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e5 3f 66 3b 4b 29 36 47 23 9f ea 49 1d d2 2e b9 |.?f;K)6G#..I....|
+| 89 04 6f 7c e5 34 dd 87 f5 69 b4 cc 06 d4 a7 72 |..o|.4...i.....r|
+| ef 94 72 fd 34 9c fc 2c f9 41 55 f7 a8 58 79 75 |..r.4..,.AU..Xyu|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef b1 f8 c8 d7 d8 42 d4 aa 82 24 fd 04 92 21 4b |......B...$...!K|
+| 6a 72 96 aa 19 82 aa fb e2 91 97 46 36 52 34 c2 |jr.........F6R4.|
+| ef b9 59 6d 7b cb 9a 7a 29 49 40 4a 7d 61 87 55 |..Ym{..z)I@J}a.U|
+| 24 7b 42 3a 69 90 53 f0 a7 2f 00 78 94 |${B:i.S../.x. |
+hash out[72]:
+| ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |......<X....Rz..|
+| 9b 0b d1 9e 7d cd 3e 9f e7 8e e1 14 9b 12 be 24 |....}.>........$|
+| a6 1d 81 f5 70 01 55 71 c0 68 be 48 38 2b 51 98 |....p.Uq.h.H8+Q.|
+| c7 ff db 07 ad 10 fb c2 71 19 ae c8 d9 64 ec 45 |........q....d.E|
+| c4 8e e9 4b d7 86 78 5a |...K..xZ |
+PRF out[72]:
+| ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |......<X....Rz..|
+| 9b 0b d1 9e 7d cd 3e 9f e7 8e e1 14 9b 12 be 24 |....}.>........$|
+| a6 1d 81 f5 70 01 55 71 c0 68 be 48 38 2b 51 98 |....p.Uq.h.H8+Q.|
+| c7 ff db 07 ad 10 fb c2 71 19 ae c8 d9 64 ec 45 |........q....d.E|
+| c4 8e e9 4b d7 86 78 5a |...K..xZ |
+key expansion[72]:
+| ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |......<X....Rz..|
+| 9b 0b d1 9e 7d cd 3e 9f e7 8e e1 14 9b 12 be 24 |....}.>........$|
+| a6 1d 81 f5 70 01 55 71 c0 68 be 48 38 2b 51 98 |....p.Uq.h.H8+Q.|
+| c7 ff db 07 ad 10 fb c2 71 19 ae c8 d9 64 ec 45 |........q....d.E|
+| c4 8e e9 4b d7 86 78 5a |...K..xZ |
+Client MAC key[20]:
+| ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |......<X....Rz..|
+| 9b 0b d1 9e |.... |
+Server MAC key[20]:
+| 7d cd 3e 9f e7 8e e1 14 9b 12 be 24 a6 1d 81 f5 |}.>........$....|
+| 70 01 55 71 |p.Uq |
+Client Write key[8]:
+| c0 68 be 48 38 2b 51 98 |.h.H8+Q. |
+Server Write key[8]:
+| c7 ff db 07 ad 10 fb c2 |........ |
+Client Write IV[8]:
+| 71 19 ae c8 d9 64 ec 45 |q....d.E |
+Server Write IV[8]:
+| c4 8e e9 4b d7 86 78 5a |...K..xZ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #83 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a69...
+looking for RSA pre-master00805c722254dd2c89207dd19ea589e58776dc10bb2bd423...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e3 7d 12 96 52 6f 48 cf 56 63 d3 4d 99 91 cd b5 |.}..RoH.Vc.M....|
+| 3d ab 66 27 d1 fc d5 80 5f 93 5e ef 74 44 3b ea |=.f'...._.^.tD;.|
+| 11 bf 87 ef 93 d3 56 37 92 bd 25 2d a1 11 95 57 |......V7..%-...W|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef b1 f8 c8 d7 d8 42 d4 aa 82 24 fd 04 92 21 4b |......B...$...!K|
+| 6a 72 96 aa 19 82 aa fb e2 91 97 46 36 52 34 c2 |jr.........F6R4.|
+| ef b9 59 6d 7b cb 9a 7a 29 49 40 4a 7d 61 87 55 |..Ym{..z)I@J}a.U|
+| 24 7b 42 3a 69 90 53 f0 a7 2f 00 78 94 |${B:i.S../.x. |
+hash out[72]:
+| ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G|
+| ff 7d 27 13 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 |.}'.....R.......|
+| fa 8d 63 7d c1 9c eb f8 45 96 60 da e7 6e 2b 44 |..c}....E.`..n+D|
+| 6c d0 7c 88 e1 d0 13 15 38 e2 72 49 8b ee ed c3 |l.|.....8.rI....|
+| 78 38 c5 82 65 80 92 08 |x8..e... |
+PRF out[72]:
+| ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G|
+| ff 7d 27 13 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 |.}'.....R.......|
+| fa 8d 63 7d c1 9c eb f8 45 96 60 da e7 6e 2b 44 |..c}....E.`..n+D|
+| 6c d0 7c 88 e1 d0 13 15 38 e2 72 49 8b ee ed c3 |l.|.....8.rI....|
+| 78 38 c5 82 65 80 92 08 |x8..e... |
+key expansion[72]:
+| ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G|
+| ff 7d 27 13 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 |.}'.....R.......|
+| fa 8d 63 7d c1 9c eb f8 45 96 60 da e7 6e 2b 44 |..c}....E.`..n+D|
+| 6c d0 7c 88 e1 d0 13 15 38 e2 72 49 8b ee ed c3 |l.|.....8.rI....|
+| 78 38 c5 82 65 80 92 08 |x8..e... |
+Client MAC key[20]:
+| ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G|
+| ff 7d 27 13 |.}'. |
+Server MAC key[20]:
+| 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 fa 8d 63 7d |....R.........c}|
+| c1 9c eb f8 |.... |
+Client Write key[8]:
+| 45 96 60 da e7 6e 2b 44 |E.`..n+D |
+Server Write key[8]:
+| 6c d0 7c 88 e1 d0 13 15 |l.|..... |
+Client Write IV[8]:
+| 38 e2 72 49 8b ee ed c3 |8.rI.... |
+Server Write IV[8]:
+| 78 38 c5 82 65 80 92 08 |x8..e... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| e3 7d 12 96 52 6f 48 cf 56 63 d3 4d 99 91 cd b5 |.}..RoH.Vc.M....|
+| 3d ab 66 27 d1 fc d5 80 5f 93 5e ef 74 44 3b ea |=.f'...._.^.tD;.|
+| 11 bf 87 ef 93 d3 56 37 92 bd 25 2d a1 11 95 57 |......V7..%-...W|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c5 86 2a 81 34 2b 24 8b 37 04 a0 f0 7d 05 a8 34 |..*.4+$.7...}..4|
+| c4 6f dc 30 8b 89 17 96 06 37 b5 66 4b 5b 98 cc |.o.0.....7.fK[..|
+| 09 43 f6 49 6d 8e 92 65 51 5b 8f 0d 74 3e 8b 26 |.C.Im..eQ[..t>.&|
+Plaintext[48]:
+| 20 fc 3a 7f da e9 b9 28 14 00 00 0c 92 79 0a 18 | .:....(.....y..|
+| e9 31 85 97 94 69 aa 49 20 26 e3 f0 c7 83 74 b9 |.1...i.I &....t.|
+| 30 60 ca 65 b4 b5 f2 6b 46 c9 bf 28 03 03 03 03 |0`.e...kF..(....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 20 26 e3 f0 c7 83 74 b9 30 60 ca 65 b4 b5 f2 6b | &....t.0`.e...k|
+| 46 c9 bf 28 |F..( |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #84 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| a1 e0 e3 ee e0 58 c5 e9 fa 3f b5 98 8f c6 48 45 |.....X...?....HE|
+| 1d 79 a7 36 96 4d ad a7 d9 2d 7f 98 a9 1c 4f c5 |.y.6.M...-....O.|
+| 82 75 86 2e ff 7e 6a 88 11 53 39 d8 d1 93 8b 82 |.u...~j..S9.....|
+Plaintext[48]:
+| 38 19 54 3f 1b 56 75 ef 14 00 00 0c bb f7 e9 4a |8.T?.Vu........J|
+| 87 b5 9a 90 fb ad 61 40 ee 38 ff 7f a9 d0 5d 94 |......a@.8....].|
+| c8 16 eb 75 d6 f2 22 0c 86 6d 3d 8c 03 03 03 03 |...u.."..m=.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 38 ff 7f a9 d0 5d 94 c8 16 eb 75 d6 f2 22 0c |.8....]....u..".|
+| 86 6d 3d 8c |.m=. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #85 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 38 4b 8b 5b cd 79 91 b8 0c a3 1e 0a dd 41 56 a3 |8K.[.y.......AV.|
+| ba c0 51 85 70 20 c1 8e 7a e3 03 cf ec 20 e1 f2 |..Q.p ..z.... ..|
+| fd b7 cc 57 1f 37 ad 57 ff e5 25 86 48 48 73 b7 |...W.7.W..%.HHs.|
+| 7d d2 bb 4c 2e 4b ce 6e d1 16 d8 5d e4 b1 4e f6 |}..L.K.n...]..N.|
+| 58 f9 99 de 33 eb db e9 d3 d4 cd f8 7d 54 5d c0 |X...3.......}T].|
+| 9c 4e 89 2b dd 0e d8 5d 2b 59 c7 a2 24 f9 86 4f |.N.+...]+Y..$..O|
+| ac 74 b9 5d 71 a6 9e b0 |.t.]q... |
+Plaintext[104]:
+| f2 b7 93 6e d8 25 62 32 47 45 54 20 2f 20 48 54 |...n.%b2GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 2d 73 68 |h-dss-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 33 0d 0a 0d |steyn.nl:4443...|
+| 0a 39 d7 a9 2d 0f 2b 49 92 85 b1 66 dd 7d 5c ea |.9..-.+I...f.}\.|
+| 30 d3 8e 17 db 02 02 02 |0....... |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d3 e2 f2 5e b4 db 3d 59 09 10 28 2a 5e fb 77 e8 |...^..=Y..(*^.w.|
+| 68 a9 e2 07 |h... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47560 found (nil)
+association_find: TCP port 4443 found 0x3734df0
+
+dissect_ssl enter frame #86 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c8 4d 53 f7 6e 86 c0 31 5f 9e 86 24 2a 82 31 2c |.MS.n..1_..$*.1,|
+| bb 1c b2 ca 77 85 d8 e5 ec af 17 f8 0e 29 43 5a |....w........)CZ|
+| ac be 66 84 38 63 02 6d 15 9e d1 06 da 55 90 b1 |..f.8c.m.....U..|
+| 1f bc 07 65 e7 cb ab fb 87 89 5e 76 c8 4b 81 a4 |...e......^v.K..|
+| 42 64 02 54 65 8c 24 b9 f4 84 e7 12 3d a3 f1 de |Bd.Te.$.....=...|
+| 19 da d6 6e a0 91 22 ab f1 cc 0a c6 8a 02 69 ca |...n..".......i.|
+| c3 14 90 db c5 2e 82 d5 1a 69 c3 39 dd 86 20 46 |.........i.9.. F|
+| ae 3b 4f c8 b0 3d 35 bc 7b 2c 94 b6 95 ac 25 59 |.;O..=5.{,....%Y|
+| d5 e1 f7 4b 2e a1 45 b8 49 b0 ac c0 e0 9b ee 33 |...K..E.I......3|
+| 62 fd a0 6d 3e dc 50 86 10 5b 10 e0 92 c6 5e 81 |b..m>.P..[....^.|
+| 42 eb ed 4c af 0c c7 fb 07 00 c0 d2 06 27 55 44 |B..L.........'UD|
+| a8 55 0e ec aa 6b 90 12 e9 14 0c 39 5a 90 bb 3d |.U...k.....9Z..=|
+| 82 ca 76 8a 05 ea 90 c9 d4 cc 50 e7 4e 36 fc db |..v.......P.N6..|
+| e5 10 02 e5 bb 6b 88 b5 69 b1 bf 90 c6 47 1f dc |.....k..i....G..|
+| 73 d5 42 60 5a ff 81 68 f4 4c 98 33 cc db 29 ac |s.B`Z..h.L.3..).|
+| 4f 6b f1 fd 79 e5 be f8 62 1e 92 6d 88 7b bc 90 |Ok..y...b..m.{..|
+| cc 39 c0 e3 b1 b3 a0 1c 9a f3 81 37 37 3f 03 79 |.9.........77?.y|
+| 68 6a 46 b1 3e fc 30 ef 4c 1a 2c ef 8b 2b 59 66 |hjF.>.0.L.,..+Yf|
+| e5 d4 85 4a bf d7 60 e7 30 2c 55 ba 13 e8 a7 f1 |...J..`.0,U.....|
+| 0a e8 71 04 7a ba 59 8a eb 9b cd 40 90 ed 79 21 |..q.z.Y....@..y!|
+| fe 91 5d 1e 04 ab 7f ec c2 38 be 77 e2 83 5d 96 |..]......8.w..].|
+| de 51 70 fb af b7 28 7d b7 b9 fd 82 e0 15 b7 81 |.Qp...(}........|
+| 9e 99 74 2c 32 52 f3 c2 2d 39 94 5b 79 4c c3 d9 |..t,2R..-9.[yL..|
+| 8d 38 64 b0 7a 7c 05 1c 76 e1 90 02 fa aa ac 8c |.8d.z|..v.......|
+Plaintext[384]:
+| 1e 40 07 e9 05 89 74 eb 48 54 54 50 2f 31 2e 31 |.@....t.HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 32 |che....0x00,0x12|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |DSS Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e c8 ac a1 0f ce 73 bc 70 09 1c ab 31 |ipt>.....s.p...1|
+| ed c4 d7 8e f9 2e 83 49 07 07 07 07 07 07 07 07 |.......I........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2b ba 9d 64 0b a5 ed af 56 48 2d ba d0 3f 1b 11 |+..d....VH-..?..|
+| 48 21 3e 1b |H!>. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4443 found 0x3734df0
+
+dissect_ssl enter frame #87 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 68 e1 f0 8e 24 16 62 b7 0a a4 07 bd a4 82 28 13 |h...$.b.......(.|
+| ee 0b 5e de 06 b0 e3 3f 98 d5 47 71 a8 12 70 01 |..^....?..Gq..p.|
+Plaintext[32]:
+| 65 a6 02 bc dd 2b 0a b7 01 00 d8 34 dd 3d 70 2f |e....+.....4.=p/|
+| 27 f7 47 b7 be 0d b2 2b 1a 92 ce 32 11 a4 01 01 |'.G....+...2....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d8 34 dd 3d 70 2f 27 f7 47 b7 be 0d b2 2b 1a 92 |.4.=p/'.G....+..|
+| ce 32 11 a4 |.2.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #89 (first time)
+ conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 02 c2 1e 30 a1 cc e0 4d 4a 2f 6d 01 b6 98 0d d1 |...0...MJ/m.....|
+| ed 0f 75 6e c0 e1 c0 62 d2 cf c9 ac 80 da ef b5 |..un...b........|
+Plaintext[32]:
+| a2 8c fe ba c9 54 52 29 01 00 80 58 b4 3b 77 c3 |.....TR)...X.;w.|
+| 5f 48 42 dc b4 ca 18 e0 6b 5a e1 3b 00 5c 01 01 |_HB.....kZ.;.\..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 80 58 b4 3b 77 c3 5f 48 42 dc b4 ca 18 e0 6b 5a |.X.;w._HB.....kZ|
+| e1 3b 00 5c |.;.\ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #94 (first time)
+ssl_session_init: initializing ptr 0x7fca45bd4aa0 size 688
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60487 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4444
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #96 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e3 7d 12 96 52 6f 48 cf 56 63 d3 4d 99 91 cd b5 |.}..RoH.Vc.M....|
+| 3d ab 66 27 d1 fc d5 80 5f 93 5e ef 74 44 3b ea |=.f'...._.^.tD;.|
+| 11 bf 87 ef 93 d3 56 37 92 bd 25 2d a1 11 95 57 |......V7..%-...W|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef 11 62 75 9c 98 f5 e2 d6 95 90 8d 43 e7 74 4b |..bu........C.tK|
+| 72 2a 00 eb 3f 4a 3c 22 e8 86 14 2a 20 52 34 c2 |r*..?J<"...* R4.|
+| ef 44 af 09 1c ca 74 a5 6b 45 c0 bc 18 43 96 73 |.D....t.kE...C.s|
+| e5 b4 f5 93 52 7a 24 f8 af 3b c7 09 20 |....Rz$..;.. |
+hash out[104]:
+| 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g|
+| f4 71 3b 75 da d0 57 07 f4 1e 79 ee 52 9c fb 1c |.q;u..W...y.R...|
+| 11 b0 9e 83 53 1e c0 9c af 41 90 ef c6 97 45 c3 |....S....A....E.|
+| d4 dd bc 9d ab a6 5a 52 f2 0d 04 35 13 32 75 15 |......ZR...5.2u.|
+| 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....|
+| d1 bf 6c fb d9 1f 0d d3 16 5f 17 02 0d 87 2d d2 |..l......_....-.|
+| 89 db b7 68 0c 3a c1 c3 |...h.:.. |
+PRF out[104]:
+| 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g|
+| f4 71 3b 75 da d0 57 07 f4 1e 79 ee 52 9c fb 1c |.q;u..W...y.R...|
+| 11 b0 9e 83 53 1e c0 9c af 41 90 ef c6 97 45 c3 |....S....A....E.|
+| d4 dd bc 9d ab a6 5a 52 f2 0d 04 35 13 32 75 15 |......ZR...5.2u.|
+| 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....|
+| d1 bf 6c fb d9 1f 0d d3 16 5f 17 02 0d 87 2d d2 |..l......_....-.|
+| 89 db b7 68 0c 3a c1 c3 |...h.:.. |
+key expansion[104]:
+| 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g|
+| f4 71 3b 75 da d0 57 07 f4 1e 79 ee 52 9c fb 1c |.q;u..W...y.R...|
+| 11 b0 9e 83 53 1e c0 9c af 41 90 ef c6 97 45 c3 |....S....A....E.|
+| d4 dd bc 9d ab a6 5a 52 f2 0d 04 35 13 32 75 15 |......ZR...5.2u.|
+| 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....|
+| d1 bf 6c fb d9 1f 0d d3 16 5f 17 02 0d 87 2d d2 |..l......_....-.|
+| 89 db b7 68 0c 3a c1 c3 |...h.:.. |
+Client MAC key[20]:
+| 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g|
+| f4 71 3b 75 |.q;u |
+Server MAC key[20]:
+| da d0 57 07 f4 1e 79 ee 52 9c fb 1c 11 b0 9e 83 |..W...y.R.......|
+| 53 1e c0 9c |S... |
+Client Write key[24]:
+| af 41 90 ef c6 97 45 c3 d4 dd bc 9d ab a6 5a 52 |.A....E.......ZR|
+| f2 0d 04 35 13 32 75 15 |...5.2u. |
+Server Write key[24]:
+| 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....|
+| d1 bf 6c fb d9 1f 0d d3 |..l..... |
+Client Write IV[8]:
+| 16 5f 17 02 0d 87 2d d2 |._....-. |
+Server Write IV[8]:
+| 89 db b7 68 0c 3a c1 c3 |...h.:.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #98 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f59352...
+looking for RSA pre-master008020de993b60cfbb0acdba730b666f94fb2461254ea18f...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 86 f6 86 1f 4a c5 1a 48 06 95 d8 d1 bf 20 aa 28 |....J..H..... .(|
+| 94 f7 fe 1d 63 7f 5c e2 92 c6 67 b6 49 a5 e0 b7 |....c.\...g.I...|
+| 02 14 6e 8a 0c 68 95 c5 b2 6d 9a 6a c1 61 64 5e |..n..h...m.j.ad^|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef 11 62 75 9c 98 f5 e2 d6 95 90 8d 43 e7 74 4b |..bu........C.tK|
+| 72 2a 00 eb 3f 4a 3c 22 e8 86 14 2a 20 52 34 c2 |r*..?J<"...* R4.|
+| ef 44 af 09 1c ca 74 a5 6b 45 c0 bc 18 43 96 73 |.D....t.kE...C.s|
+| e5 b4 f5 93 52 7a 24 f8 af 3b c7 09 20 |....Rz$..;.. |
+hash out[104]:
+| 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.|
+| 40 7e 15 a2 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 |@~..o.$.l.. ..j.|
+| 1e b4 f1 b5 db 41 1f 65 ef 0c ce 75 64 de 59 e7 |.....A.e...ud.Y.|
+| 4d e1 16 a7 17 fd cb 2f 78 05 80 54 40 f3 1c 4b |M....../x..T@..K|
+| cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..|
+| 19 5d 94 a4 bc b7 f0 d2 9a 4d 10 fc 7f fa cc 0d |.].......M......|
+| 3f cf c9 c4 4d f4 75 83 |?...M.u. |
+PRF out[104]:
+| 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.|
+| 40 7e 15 a2 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 |@~..o.$.l.. ..j.|
+| 1e b4 f1 b5 db 41 1f 65 ef 0c ce 75 64 de 59 e7 |.....A.e...ud.Y.|
+| 4d e1 16 a7 17 fd cb 2f 78 05 80 54 40 f3 1c 4b |M....../x..T@..K|
+| cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..|
+| 19 5d 94 a4 bc b7 f0 d2 9a 4d 10 fc 7f fa cc 0d |.].......M......|
+| 3f cf c9 c4 4d f4 75 83 |?...M.u. |
+key expansion[104]:
+| 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.|
+| 40 7e 15 a2 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 |@~..o.$.l.. ..j.|
+| 1e b4 f1 b5 db 41 1f 65 ef 0c ce 75 64 de 59 e7 |.....A.e...ud.Y.|
+| 4d e1 16 a7 17 fd cb 2f 78 05 80 54 40 f3 1c 4b |M....../x..T@..K|
+| cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..|
+| 19 5d 94 a4 bc b7 f0 d2 9a 4d 10 fc 7f fa cc 0d |.].......M......|
+| 3f cf c9 c4 4d f4 75 83 |?...M.u. |
+Client MAC key[20]:
+| 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.|
+| 40 7e 15 a2 |@~.. |
+Server MAC key[20]:
+| 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 1e b4 f1 b5 |o.$.l.. ..j.....|
+| db 41 1f 65 |.A.e |
+Client Write key[24]:
+| ef 0c ce 75 64 de 59 e7 4d e1 16 a7 17 fd cb 2f |...ud.Y.M....../|
+| 78 05 80 54 40 f3 1c 4b |x..T@..K |
+Server Write key[24]:
+| cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..|
+| 19 5d 94 a4 bc b7 f0 d2 |.]...... |
+Client Write IV[8]:
+| 9a 4d 10 fc 7f fa cc 0d |.M...... |
+Server Write IV[8]:
+| 3f cf c9 c4 4d f4 75 83 |?...M.u. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 86 f6 86 1f 4a c5 1a 48 06 95 d8 d1 bf 20 aa 28 |....J..H..... .(|
+| 94 f7 fe 1d 63 7f 5c e2 92 c6 67 b6 49 a5 e0 b7 |....c.\...g.I...|
+| 02 14 6e 8a 0c 68 95 c5 b2 6d 9a 6a c1 61 64 5e |..n..h...m.j.ad^|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 35 fb 98 49 ec b1 be 7c d7 c0 49 c0 d8 20 7d ac |5..I...|..I.. }.|
+| 58 18 20 f2 99 73 20 9c f1 50 76 34 1a de ea 4c |X. ..s ..Pv4...L|
+| 8f 4e 9b 09 6f 63 b8 1d e0 0d 35 07 8c e1 16 38 |.N..oc....5....8|
+Plaintext[48]:
+| d4 93 b7 1c 0f e3 dc 47 14 00 00 0c b1 1b 76 f0 |.......G......v.|
+| 03 db ec 76 17 1f 1e d9 0c 15 74 cc 1a ab 8b af |...v......t.....|
+| c8 49 6b 98 62 93 08 29 6d d3 3a bb 03 03 03 03 |.Ik.b..)m.:.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0c 15 74 cc 1a ab 8b af c8 49 6b 98 62 93 08 29 |..t......Ik.b..)|
+| 6d d3 3a bb |m.:. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #99 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d9 d5 d4 38 af 7f a2 68 81 32 fa 9f 86 93 32 86 |...8...h.2....2.|
+| a7 de 91 be 90 e5 c3 38 cb 68 54 1f 17 36 62 58 |.......8.hT..6bX|
+| 50 1b c6 85 44 aa 70 fb 63 bf 43 de 4f b6 8a 05 |P...D.p.c.C.O...|
+Plaintext[48]:
+| c3 5a aa 2c 9e e9 e0 77 14 00 00 0c 40 96 47 94 |.Z.,...w....@.G.|
+| fc 68 59 87 c6 7c cb 19 a1 5d 72 08 e6 43 dc 90 |.hY..|...]r..C..|
+| ce fc 04 e9 05 28 14 1d db 49 bd a7 03 03 03 03 |.....(...I......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 5d 72 08 e6 43 dc 90 ce fc 04 e9 05 28 14 1d |.]r..C.......(..|
+| db 49 bd a7 |.I.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #100 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 4a 27 f9 97 f3 de 82 08 bf 0c 15 37 91 e4 d6 5b |J'.........7...[|
+| 90 97 a8 77 b5 70 f0 b7 1a 22 ed 7d 02 24 83 3f |...w.p...".}.$.?|
+| 02 a9 32 e7 f5 52 64 e8 91 53 7d 3b 32 b7 59 97 |..2..Rd..S};2.Y.|
+| fd e2 84 02 df dd 2b 47 c2 de d5 31 58 64 3d 05 |......+G...1Xd=.|
+| 47 0a 17 24 ca 62 0b a8 71 c8 98 f0 6f 9b 8c 72 |G..$.b..q...o..r|
+| 86 ea e9 ee 17 f3 77 9d 9b a2 1e ed 3f 19 1d 62 |......w.....?..b|
+| ad fd 93 80 f9 5c 07 30 |.....\.0 |
+Plaintext[104]:
+| 1b 91 1e 10 6f 09 4f 78 47 45 54 20 2f 20 48 54 |....o.OxGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 33 2d 73 |h-dss-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 34 0d 0a |nsteyn.nl:4444..|
+| 0d 0a a5 65 96 d6 b2 56 0b f1 dd 88 58 59 ae d6 |...e...V....XY..|
+| 5f de c5 ea ea 3c 01 01 |_....<.. |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c1 3d af 3c ce 3d 8f cf a0 85 25 92 54 af e9 8a |.=.<.=....%.T...|
+| 8a 4e 9b 99 |.N.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60487 found (nil)
+association_find: TCP port 4444 found 0x3734e80
+
+dissect_ssl enter frame #101 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 26 ad 0b 0d 35 eb ec 78 89 85 26 7e d8 7c 9e 2f |&...5..x..&~.|./|
+| f2 e0 2f c4 e4 5e 57 26 82 a3 fe a3 ae 9a 24 cf |../..^W&......$.|
+| 31 ab d4 93 c6 92 8b ae c2 58 17 82 82 4b b0 fa |1........X...K..|
+| fb 6e 63 bb fc fa a7 81 5d e5 50 32 bf e8 22 e8 |.nc.....].P2..".|
+| e1 eb c4 f1 f0 67 a1 16 6d 61 df 78 a9 c5 c1 52 |.....g..ma.x...R|
+| c0 6e ba ca 44 d2 71 62 a8 42 bb 37 cf 95 48 5f |.n..D.qb.B.7..H_|
+| 78 7b 36 0a fe d2 9e 50 c1 3f ed fa 2a a7 e2 59 |x{6....P.?..*..Y|
+| 42 97 9d a5 21 1d f1 b5 ae 0b 58 af 9f 02 22 01 |B...!.....X...".|
+| be f1 fc c4 31 b0 b1 45 96 de a4 b2 73 62 57 45 |....1..E....sbWE|
+| 27 6d 0c 12 98 42 ab 3f f6 21 7a 66 37 61 b6 61 |'m...B.?.!zf7a.a|
+| 70 64 79 9e 80 e0 6b 23 c9 8c 01 98 8e 19 70 7f |pdy...k#......p.|
+| 46 65 d3 fd e4 07 e3 2d 0a 4f de 9b 9b 1c 9b c7 |Fe.....-.O......|
+| 1c a3 29 1b 07 19 31 3c b6 97 5a 28 b2 96 89 70 |..)...1<..Z(...p|
+| 84 a0 7c 6a 27 e7 07 d6 39 84 8b d4 54 0f 06 dc |..|j'...9...T...|
+| ca 54 49 95 59 48 46 31 8c c2 f5 ac 3c f1 b0 23 |.TI.YHF1....<..#|
+| b8 8f b0 23 4c 33 8a ab c4 c8 76 79 aa 93 e1 83 |...#L3....vy....|
+| ee fc 8a 21 6e 44 55 a8 c1 2d 2a 42 bb 91 00 d9 |...!nDU..-*B....|
+| bb 9e 6d cd 39 2f fd 10 ae 5a 23 e4 2d 56 c2 53 |..m.9/...Z#.-V.S|
+| be 3a ce 53 a3 59 85 30 6f 15 e2 0a 42 7f bc ee |.:.S.Y.0o...B...|
+| 44 3a db ad af 4c 13 d7 77 e3 df 2f 8c 49 e5 1f |D:...L..w../.I..|
+| 01 fc 4f b6 16 cc 54 5c 3c db c3 19 a9 4e f7 53 |..O...T\<....N.S|
+| af 1b 3d 9e 5e 6a 37 6b bb 1c 85 6c 6e 2f ec 6a |..=.^j7k...ln/.j|
+| 55 69 c0 60 4b c2 65 df c1 48 e9 2d cb 31 1b 1a |Ui.`K.e..H.-.1..|
+| 99 8f 5e c1 77 0d 32 e9 72 7b 10 de 85 68 d4 94 |..^.w.2.r{...h..|
+Plaintext[384]:
+| 24 73 2f 8d 55 bb 51 e1 48 54 54 50 2f 31 2e 31 |$s/.U.Q.HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 33 |che....0x00,0x13|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |DSS Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 31 08 3c 04 a8 5f 40 02 eb e0 69 75 |ipt>1.<.._@...iu|
+| 1f cf 93 55 7a 28 55 d0 07 07 07 07 07 07 07 07 |...Uz(U.........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| df 04 ff ec 1a a0 5e 39 82 b4 43 27 d8 37 3c b6 |......^9..C'.7<.|
+| 3a 41 1d 1f |:A.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4444 found 0x3734e80
+
+dissect_ssl enter frame #102 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| c2 f8 35 27 3a 16 4b 1c 9b 34 30 3c cf e1 1c 62 |..5':.K..40<...b|
+| e2 bf 83 76 44 54 f4 d0 c2 cc 89 d7 2d 9a 94 2f |...vDT......-../|
+Plaintext[32]:
+| 09 b8 35 59 cf d3 17 63 01 00 63 7e ab 69 c7 80 |..5Y...c..c~.i..|
+| b2 dc 9c 02 a0 ff 04 0f 25 35 95 55 68 a3 01 01 |........%5.Uh...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 63 7e ab 69 c7 80 b2 dc 9c 02 a0 ff 04 0f 25 35 |c~.i..........%5|
+| 95 55 68 a3 |.Uh. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #104 (first time)
+ conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 65 dc c2 7f 58 96 de 4c e1 ad 17 b1 b5 5b 6b 93 |e...X..L.....[k.|
+| 72 bb e4 e9 fe 49 25 dd f1 1e 05 3d 31 8f 7b 1f |r....I%....=1.{.|
+Plaintext[32]:
+| 78 1c 38 f6 f6 2b de d9 01 00 9c fe 29 fd b9 04 |x.8..+......)...|
+| 9a 1a a8 c3 a3 22 3b 7e d8 e3 40 39 f4 71 01 01 |.....";~..@9.q..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c fe 29 fd b9 04 9a 1a a8 c3 a3 22 3b 7e d8 e3 |..)........";~..|
+| 40 39 f4 71 |@9.q |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #109 (first time)
+ssl_session_init: initializing ptr 0x7fca45bd6fa0 size 688
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34497 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4446
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #111 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 86 f6 86 1f 4a c5 1a 48 06 95 d8 d1 bf 20 aa 28 |....J..H..... .(|
+| 94 f7 fe 1d 63 7f 5c e2 92 c6 67 b6 49 a5 e0 b7 |....c.\...g.I...|
+| 02 14 6e 8a 0c 68 95 c5 b2 6d 9a 6a c1 61 64 5e |..n..h...m.j.ad^|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef ed f3 e6 31 02 3f b8 ca 90 98 20 c2 4f ee db |....1.?.... .O..|
+| c6 1f 95 63 7b 7a b7 51 9f 1e 32 a6 64 52 34 c2 |...c{z.Q..2.dR4.|
+| ef 9c 1b c4 6c 87 f7 d2 f0 e4 41 be 57 74 df 90 |....l.....A.Wt..|
+| 5d ee 5a ec 15 c7 46 61 e3 bc cd 50 d4 |].Z...Fa...P. |
+hash out[72]:
+| 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.|
+| 2e b4 10 e1 da 73 49 68 c5 8b 8f 3b c4 72 dd c8 |.....sIh...;.r..|
+| 51 eb a2 32 fb 8a 29 b0 1c 2e c3 27 96 76 71 ac |Q..2..)....'.vq.|
+| c0 4e 98 7a 4f 49 d8 c9 77 4e 80 25 3e bb 1d 25 |.N.zOI..wN.%>..%|
+| e3 3d 6a 21 88 33 23 13 |.=j!.3#. |
+PRF out[72]:
+| 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.|
+| 2e b4 10 e1 da 73 49 68 c5 8b 8f 3b c4 72 dd c8 |.....sIh...;.r..|
+| 51 eb a2 32 fb 8a 29 b0 1c 2e c3 27 96 76 71 ac |Q..2..)....'.vq.|
+| c0 4e 98 7a 4f 49 d8 c9 77 4e 80 25 3e bb 1d 25 |.N.zOI..wN.%>..%|
+| e3 3d 6a 21 88 33 23 13 |.=j!.3#. |
+key expansion[72]:
+| 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.|
+| 2e b4 10 e1 da 73 49 68 c5 8b 8f 3b c4 72 dd c8 |.....sIh...;.r..|
+| 51 eb a2 32 fb 8a 29 b0 1c 2e c3 27 96 76 71 ac |Q..2..)....'.vq.|
+| c0 4e 98 7a 4f 49 d8 c9 77 4e 80 25 3e bb 1d 25 |.N.zOI..wN.%>..%|
+| e3 3d 6a 21 88 33 23 13 |.=j!.3#. |
+Client MAC key[20]:
+| 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.|
+| 2e b4 10 e1 |.... |
+Server MAC key[20]:
+| da 73 49 68 c5 8b 8f 3b c4 72 dd c8 51 eb a2 32 |.sIh...;.r..Q..2|
+| fb 8a 29 b0 |..). |
+Client Write key[8]:
+| 1c 2e c3 27 96 76 71 ac |...'.vq. |
+Server Write key[8]:
+| c0 4e 98 7a 4f 49 d8 c9 |.N.zOI.. |
+Client Write IV[8]:
+| 77 4e 80 25 3e bb 1d 25 |wN.%>..% |
+Server Write IV[8]:
+| e3 3d 6a 21 88 33 23 13 |.=j!.3#. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #113 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15...
+looking for RSA pre-master0080b153193d083e0e7d55db97bb93ac58e64fb42a1b983c...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| b5 83 9e c0 5c 29 da d6 36 e0 d2 4b 94 da 8b 17 |....\)..6..K....|
+| b7 5b 00 6b 0a b1 49 fb 08 57 92 81 1f df af 08 |.[.k..I..W......|
+| 87 e1 4a 03 57 cf 73 b1 a5 9f e8 c1 8a ae c7 74 |..J.W.s........t|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef ed f3 e6 31 02 3f b8 ca 90 98 20 c2 4f ee db |....1.?.... .O..|
+| c6 1f 95 63 7b 7a b7 51 9f 1e 32 a6 64 52 34 c2 |...c{z.Q..2.dR4.|
+| ef 9c 1b c4 6c 87 f7 d2 f0 e4 41 be 57 74 df 90 |....l.....A.Wt..|
+| 5d ee 5a ec 15 c7 46 61 e3 bc cd 50 d4 |].Z...Fa...P. |
+hash out[72]:
+| ea 93 23 3f b9 da a1 11 3a 29 1d 64 b3 ba 9b 1b |..#?....:).d....|
+| 58 a8 04 fd 45 00 2e cb 34 25 bf b1 cb 92 3d 81 |X...E...4%....=.|
+| ab df 46 28 8a 35 d8 c2 ca 36 63 18 c9 da 6a 7e |..F(.5...6c...j~|
+| e6 23 c6 9d 4c 6b 4f f0 48 d5 25 b3 bd 90 e5 18 |.#..LkO.H.%.....|
+| d2 45 d6 ff 2c 7b 3c 41 |.E..,{<A |
+PRF out[72]:
+| ea 93 23 3f b9 da a1 11 3a 29 1d 64 b3 ba 9b 1b |..#?....:).d....|
+| 58 a8 04 fd 45 00 2e cb 34 25 bf b1 cb 92 3d 81 |X...E...4%....=.|
+| ab df 46 28 8a 35 d8 c2 ca 36 63 18 c9 da 6a 7e |..F(.5...6c...j~|
+| e6 23 c6 9d 4c 6b 4f f0 48 d5 25 b3 bd 90 e5 18 |.#..LkO.H.%.....|
+| d2 45 d6 ff 2c 7b 3c 41 |.E..,{<A |
+key expansion[72]:
+| ea 93 23 3f b9 da a1 11 3a 29 1d 64 b3 ba 9b 1b |..#?....:).d....|
+| 58 a8 04 fd 45 00 2e cb 34 25 bf b1 cb 92 3d 81 |X...E...4%....=.|
+| ab df 46 28 8a 35 d8 c2 ca 36 63 18 c9 da 6a 7e |..F(.5...6c...j~|
+| e6 23 c6 9d 4c 6b 4f f0 48 d5 25 b3 bd 90 e5 18 |.#..LkO.H.%.....|
+| d2 45 d6 ff 2c 7b 3c 41 |.E..,{<A |
+Client MAC key[20]:
+| ea 93 23 3f b9 da a1 11 3a 29 1d 64 b3 ba 9b 1b |..#?....:).d....|
+| 58 a8 04 fd |X... |
+Server MAC key[20]:
+| 45 00 2e cb 34 25 bf b1 cb 92 3d 81 ab df 46 28 |E...4%....=...F(|
+| 8a 35 d8 c2 |.5.. |
+Client Write key[8]:
+| ca 36 63 18 c9 da 6a 7e |.6c...j~ |
+Server Write key[8]:
+| e6 23 c6 9d 4c 6b 4f f0 |.#..LkO. |
+Client Write IV[8]:
+| 48 d5 25 b3 bd 90 e5 18 |H.%..... |
+Server Write IV[8]:
+| d2 45 d6 ff 2c 7b 3c 41 |.E..,{<A |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| b5 83 9e c0 5c 29 da d6 36 e0 d2 4b 94 da 8b 17 |....\)..6..K....|
+| b7 5b 00 6b 0a b1 49 fb 08 57 92 81 1f df af 08 |.[.k..I..W......|
+| 87 e1 4a 03 57 cf 73 b1 a5 9f e8 c1 8a ae c7 74 |..J.W.s........t|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 30 19 78 39 c5 e2 f0 67 25 44 a0 6e 99 4d 72 6d |0.x9...g%D.n.Mrm|
+| e6 7b 8b 75 05 af 98 17 96 91 7f b5 3d e0 dc 53 |.{.u........=..S|
+| b2 89 10 66 96 81 2e 3c 36 fd 0c b1 db 09 a6 44 |...f...<6......D|
+Plaintext[48]:
+| 7b c2 78 b7 66 d5 6a 3b 14 00 00 0c de 2a 7f 2a |{.x.f.j;.....*.*|
+| 04 8b c5 59 df ee 6a 4e 01 1c 13 d0 b4 b0 49 46 |...Y..jN......IF|
+| 5c b2 ec 1b ab 0b 82 71 ef 89 4f 70 03 03 03 03 |\......q..Op....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 01 1c 13 d0 b4 b0 49 46 5c b2 ec 1b ab 0b 82 71 |......IF\......q|
+| ef 89 4f 70 |..Op |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #114 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| a6 b9 ac ea e6 5e 62 db e5 29 90 c1 9d b6 d1 df |.....^b..)......|
+| ec 63 cd 50 85 d6 08 4e 51 4a 85 dc 2f 69 1f 14 |.c.P...NQJ../i..|
+| 24 d9 3d 17 c2 ec 5f 72 44 b2 87 7a 70 4a a0 39 |$.=..._rD..zpJ.9|
+Plaintext[48]:
+| 93 6f 05 5a 88 c8 bd 0c 14 00 00 0c ea ca 80 8d |.o.Z............|
+| 80 5a fe 99 29 07 64 0c 8c ed 4b 37 f3 73 80 36 |.Z..).d...K7.s.6|
+| e9 f8 7b fd cf 10 c7 f1 d6 82 69 a0 03 03 03 03 |..{.......i.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c ed 4b 37 f3 73 80 36 e9 f8 7b fd cf 10 c7 f1 |..K7.s.6..{.....|
+| d6 82 69 a0 |..i. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #115 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 71 62 a6 17 29 f4 67 aa 28 4a e1 ca 34 1d d8 1c |qb..).g.(J..4...|
+| 22 4b 4f 85 20 02 d2 be 9b f5 da d9 6e 13 d4 d1 |"KO. .......n...|
+| c1 66 f6 96 29 e1 52 82 f1 9f 1a 86 4f ce 58 9b |.f..).R.....O.X.|
+| e0 62 4e 50 80 cc 9f 2c c2 c9 b5 51 cf 2e f0 1a |.bNP...,...Q....|
+| 0e 63 bf ac e2 33 7d 24 fc 4b 5d 4b 9e 6e 6c 2a |.c...3}$.K]K.nl*|
+| e0 ee 67 f7 7c c7 2e ee b1 5b a3 a8 d0 60 1d 6b |..g.|....[...`.k|
+| f0 d7 87 fd 83 ce d4 c0 |........ |
+Plaintext[104]:
+| 94 37 31 3d 67 88 79 6b 47 45 54 20 2f 20 48 54 |.71=g.ykGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 2d 73 68 |h-rsa-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 36 0d 0a 0d |steyn.nl:4446...|
+| 0a 5d 71 29 b3 48 eb d7 e3 1b f0 5e cd fd a1 90 |.]q).H.....^....|
+| ed 88 47 87 44 02 02 02 |..G.D... |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9d 48 26 87 0d 4f b8 db 1f f8 b2 d1 47 ee 3d c1 |.H&..O......G.=.|
+| 2d 6d ed aa |-m.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34497 found (nil)
+association_find: TCP port 4446 found 0x3734fa0
+
+dissect_ssl enter frame #116 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| a4 d2 3f 8a be 06 a6 e2 0d 07 4d e8 16 c8 70 da |..?.......M...p.|
+| 41 e4 cb df dd 8a fb af 73 18 b7 f0 78 88 c0 b5 |A.......s...x...|
+| 20 5e 15 f8 b7 bc e9 19 4a a4 29 5d b7 d6 08 59 | ^......J.)]...Y|
+| 83 b9 de ff e3 3f 02 3c e7 4f 2a 06 60 33 77 13 |.....?.<.O*.`3w.|
+| 47 e8 41 eb 54 33 55 92 c3 73 58 8b f1 36 21 a7 |G.A.T3U..sX..6!.|
+| b4 fc c3 f8 0f 1b fb ee 21 c4 83 66 88 a3 54 13 |........!..f..T.|
+| 02 f4 bc 97 97 fe 47 08 45 d2 1b 99 5e f0 1f 52 |......G.E...^..R|
+| 05 3a 44 9b af ff e5 f8 fd 6c 88 af 3f b6 65 4f |.:D......l..?.eO|
+| 76 0c 3a b8 02 e3 73 10 a7 f0 6c 40 98 a4 8a 2f |v.:...s...l@.../|
+| ed b4 35 09 30 ea 5e 22 a8 b0 12 1d df b4 fc f8 |..5.0.^"........|
+| 04 c4 bb ee 9f ef 2a 1c 7b ee 73 69 cb 3d 13 a4 |......*.{.si.=..|
+| eb bf d2 b4 01 9b c2 4d 14 8b c2 8b a5 3f 6a 1c |.......M.....?j.|
+| 01 85 a9 1d 1b cd 4e a1 c2 5d 45 ca af 2d 1c 8f |......N..]E..-..|
+| 46 2f 72 c3 7a dd 4c 89 71 9c a9 88 bf 81 4c 4f |F/r.z.L.q.....LO|
+| e1 3c bf 21 7a 74 5b 73 29 c1 b5 bb 22 d7 ca ab |.<.!zt[s)..."...|
+| 31 61 18 55 79 69 21 4d f2 d0 a2 f8 90 67 e6 52 |1a.Uyi!M.....g.R|
+| 76 79 0e 52 b5 e5 fe 62 b9 a7 bf a3 e5 ec 3a df |vy.R...b......:.|
+| 49 c5 1a 4e c8 68 38 e5 24 25 21 5b 84 5f 3b 00 |I..N.h8.$%![._;.|
+| 69 6c ac 77 f7 9d f1 4c 0e a2 f3 4d 69 b1 80 00 |il.w...L...Mi...|
+| 85 dd 40 b2 f2 76 51 b1 da 56 e2 87 7c 5f bf 62 |..@..vQ..V..|_.b|
+| 42 cc 6c e8 1c f4 d3 7e 03 8c 2f 0e 01 39 1f 15 |B.l....~../..9..|
+| 59 11 c9 5b f2 b8 d8 30 35 7c 43 ba 8a 2c 1e 89 |Y..[...05|C..,..|
+| 34 7b 3d 29 99 90 02 51 0f b1 5b e3 cc c2 7d 5a |4{=)...Q..[...}Z|
+| fd ae d3 02 c8 43 e6 d8 f5 a0 25 a4 aa 32 d0 66 |.....C....%..2.f|
+Plaintext[384]:
+| 3f af 17 8d 22 e2 24 ab 48 54 54 50 2f 31 2e 31 |?...".$.HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 35 |che....0x00,0x15|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 0a 37 b8 9e 52 dc 45 ea 19 54 ed 94 |ipt>.7..R.E..T..|
+| 1e e9 87 fb 8f 76 8f 41 07 07 07 07 07 07 07 07 |.....v.A........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c6 f7 05 b7 17 9c 0c 94 4b f2 f5 74 65 57 a5 0a |........K..teW..|
+| 55 c0 f1 c3 |U... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4446 found 0x3734fa0
+
+dissect_ssl enter frame #117 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 0e 8e 18 d1 ab 56 64 be 92 d6 86 bd fc 3b 56 9a |.....Vd......;V.|
+| f8 24 a8 2d 15 28 4f ba 69 1a d8 14 20 49 31 e9 |.$.-.(O.i... I1.|
+Plaintext[32]:
+| ce 6d 59 c2 16 f3 b8 1a 01 00 7d 13 30 34 76 7e |.mY.......}.04v~|
+| 8b 72 a9 b4 65 d1 0c 74 6c 3a 57 52 bc b1 01 01 |.r..e..tl:WR....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7d 13 30 34 76 7e 8b 72 a9 b4 65 d1 0c 74 6c 3a |}.04v~.r..e..tl:|
+| 57 52 bc b1 |WR.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #119 (first time)
+ conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 22 e0 e6 b6 79 c3 06 2f de a4 b7 cc 46 c6 0f 54 |"...y../....F..T|
+| 78 95 6b 12 be f4 7f bd 6e d4 43 76 dd 7e 3e 2b |x.k.....n.Cv.~>+|
+Plaintext[32]:
+| 4e fc ac 63 df 22 25 87 01 00 11 d4 19 6f 99 8d |N..c."%......o..|
+| ce 0b cd 1c b6 ef af a2 2a 2d 51 28 ad 72 01 01 |........*-Q(.r..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 11 d4 19 6f 99 8d ce 0b cd 1c b6 ef af a2 2a 2d |...o..........*-|
+| 51 28 ad 72 |Q(.r |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #124 (first time)
+ssl_session_init: initializing ptr 0x7fca45bd94a0 size 688
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34715 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4447
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #126 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| b5 83 9e c0 5c 29 da d6 36 e0 d2 4b 94 da 8b 17 |....\)..6..K....|
+| b7 5b 00 6b 0a b1 49 fb 08 57 92 81 1f df af 08 |.[.k..I..W......|
+| 87 e1 4a 03 57 cf 73 b1 a5 9f e8 c1 8a ae c7 74 |..J.W.s........t|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef 7a 50 f4 f6 76 42 6b 9d a8 3e e8 67 59 b1 1a |.zP..vBk..>.gY..|
+| 44 85 0b 1d c7 c1 ce 8a d6 ce e1 9f ed 52 34 c2 |D............R4.|
+| ef cd 72 18 d5 97 f7 e6 30 f7 2b b4 1f 08 d6 3d |..r.....0.+....=|
+| cd 1c 21 41 14 e5 3f db 91 00 93 ba 24 |..!A..?.....$ |
+hash out[104]:
+| 4a ff ec 37 ef 82 83 8f a8 40 28 3c 66 86 a9 94 |J..7.....@(<f...|
+| 14 9d 85 9e 9a 27 e1 50 99 8c 96 ff 30 01 b0 c6 |.....'.P....0...|
+| d1 54 dd 61 97 17 ee 42 1c ae a5 50 86 97 a9 0d |.T.a...B...P....|
+| cf 65 a7 5d 5d 8e 99 6f 6b 94 41 b3 f2 b7 3b d2 |.e.]]..ok.A...;.|
+| 9e f3 98 e6 87 37 53 f4 e4 09 8e c5 73 39 39 f9 |.....7S.....s99.|
+| ef 30 21 9f 07 8b 3d 50 04 93 4b ed 1f a2 62 e5 |.0!...=P..K...b.|
+| 76 bf 97 2c 33 26 72 ca |v..,3&r. |
+PRF out[104]:
+| 4a ff ec 37 ef 82 83 8f a8 40 28 3c 66 86 a9 94 |J..7.....@(<f...|
+| 14 9d 85 9e 9a 27 e1 50 99 8c 96 ff 30 01 b0 c6 |.....'.P....0...|
+| d1 54 dd 61 97 17 ee 42 1c ae a5 50 86 97 a9 0d |.T.a...B...P....|
+| cf 65 a7 5d 5d 8e 99 6f 6b 94 41 b3 f2 b7 3b d2 |.e.]]..ok.A...;.|
+| 9e f3 98 e6 87 37 53 f4 e4 09 8e c5 73 39 39 f9 |.....7S.....s99.|
+| ef 30 21 9f 07 8b 3d 50 04 93 4b ed 1f a2 62 e5 |.0!...=P..K...b.|
+| 76 bf 97 2c 33 26 72 ca |v..,3&r. |
+key expansion[104]:
+| 4a ff ec 37 ef 82 83 8f a8 40 28 3c 66 86 a9 94 |J..7.....@(<f...|
+| 14 9d 85 9e 9a 27 e1 50 99 8c 96 ff 30 01 b0 c6 |.....'.P....0...|
+| d1 54 dd 61 97 17 ee 42 1c ae a5 50 86 97 a9 0d |.T.a...B...P....|
+| cf 65 a7 5d 5d 8e 99 6f 6b 94 41 b3 f2 b7 3b d2 |.e.]]..ok.A...;.|
+| 9e f3 98 e6 87 37 53 f4 e4 09 8e c5 73 39 39 f9 |.....7S.....s99.|
+| ef 30 21 9f 07 8b 3d 50 04 93 4b ed 1f a2 62 e5 |.0!...=P..K...b.|
+| 76 bf 97 2c 33 26 72 ca |v..,3&r. |
+Client MAC key[20]:
+| 4a ff ec 37 ef 82 83 8f a8 40 28 3c 66 86 a9 94 |J..7.....@(<f...|
+| 14 9d 85 9e |.... |
+Server MAC key[20]:
+| 9a 27 e1 50 99 8c 96 ff 30 01 b0 c6 d1 54 dd 61 |.'.P....0....T.a|
+| 97 17 ee 42 |...B |
+Client Write key[24]:
+| 1c ae a5 50 86 97 a9 0d cf 65 a7 5d 5d 8e 99 6f |...P.....e.]]..o|
+| 6b 94 41 b3 f2 b7 3b d2 |k.A...;. |
+Server Write key[24]:
+| 9e f3 98 e6 87 37 53 f4 e4 09 8e c5 73 39 39 f9 |.....7S.....s99.|
+| ef 30 21 9f 07 8b 3d 50 |.0!...=P |
+Client Write IV[8]:
+| 04 93 4b ed 1f a2 62 e5 |..K...b. |
+Server Write IV[8]:
+| 76 bf 97 2c 33 26 72 ca |v..,3&r. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #128 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114...
+looking for RSA pre-master008088221c63c64a3b70e4b6bac452859d23162a0b450ad7...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 32 1e ca 17 8e 72 c8 b6 cf 4d 06 65 12 1f 99 f5 |2....r...M.e....|
+| ec 24 8d 3a 1c 08 7c 2b d2 76 f4 fe de 48 88 e2 |.$.:..|+.v...H..|
+| cb 34 3c c8 44 4c 4c 30 aa eb 10 ab 43 66 c6 b4 |.4<.DLL0....Cf..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| ef 7a 50 f4 f6 76 42 6b 9d a8 3e e8 67 59 b1 1a |.zP..vBk..>.gY..|
+| 44 85 0b 1d c7 c1 ce 8a d6 ce e1 9f ed 52 34 c2 |D............R4.|
+| ef cd 72 18 d5 97 f7 e6 30 f7 2b b4 1f 08 d6 3d |..r.....0.+....=|
+| cd 1c 21 41 14 e5 3f db 91 00 93 ba 24 |..!A..?.....$ |
+hash out[104]:
+| b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...|
+| b0 39 19 56 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 |.9.VpR0.0...%.~.|
+| e4 8f 61 0b 9b 73 4e 2b f2 ef d8 4f f6 68 38 f3 |..a..sN+...O.h8.|
+| 34 a3 c8 94 e9 f1 41 51 89 31 e1 60 9c 57 2e 5a |4.....AQ.1.`.W.Z|
+| 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I|
+| 6c db 30 c7 6e a8 9d b1 30 36 3f b2 37 ec 83 0a |l.0.n...06?.7...|
+| 78 52 b7 8c 48 38 56 4c |xR..H8VL |
+PRF out[104]:
+| b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...|
+| b0 39 19 56 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 |.9.VpR0.0...%.~.|
+| e4 8f 61 0b 9b 73 4e 2b f2 ef d8 4f f6 68 38 f3 |..a..sN+...O.h8.|
+| 34 a3 c8 94 e9 f1 41 51 89 31 e1 60 9c 57 2e 5a |4.....AQ.1.`.W.Z|
+| 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I|
+| 6c db 30 c7 6e a8 9d b1 30 36 3f b2 37 ec 83 0a |l.0.n...06?.7...|
+| 78 52 b7 8c 48 38 56 4c |xR..H8VL |
+key expansion[104]:
+| b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...|
+| b0 39 19 56 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 |.9.VpR0.0...%.~.|
+| e4 8f 61 0b 9b 73 4e 2b f2 ef d8 4f f6 68 38 f3 |..a..sN+...O.h8.|
+| 34 a3 c8 94 e9 f1 41 51 89 31 e1 60 9c 57 2e 5a |4.....AQ.1.`.W.Z|
+| 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I|
+| 6c db 30 c7 6e a8 9d b1 30 36 3f b2 37 ec 83 0a |l.0.n...06?.7...|
+| 78 52 b7 8c 48 38 56 4c |xR..H8VL |
+Client MAC key[20]:
+| b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...|
+| b0 39 19 56 |.9.V |
+Server MAC key[20]:
+| 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 e4 8f 61 0b |pR0.0...%.~...a.|
+| 9b 73 4e 2b |.sN+ |
+Client Write key[24]:
+| f2 ef d8 4f f6 68 38 f3 34 a3 c8 94 e9 f1 41 51 |...O.h8.4.....AQ|
+| 89 31 e1 60 9c 57 2e 5a |.1.`.W.Z |
+Server Write key[24]:
+| 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I|
+| 6c db 30 c7 6e a8 9d b1 |l.0.n... |
+Client Write IV[8]:
+| 30 36 3f b2 37 ec 83 0a |06?.7... |
+Server Write IV[8]:
+| 78 52 b7 8c 48 38 56 4c |xR..H8VL |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 32 1e ca 17 8e 72 c8 b6 cf 4d 06 65 12 1f 99 f5 |2....r...M.e....|
+| ec 24 8d 3a 1c 08 7c 2b d2 76 f4 fe de 48 88 e2 |.$.:..|+.v...H..|
+| cb 34 3c c8 44 4c 4c 30 aa eb 10 ab 43 66 c6 b4 |.4<.DLL0....Cf..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 6f e7 6f 29 2a 3f 3d 60 13 2d a9 70 32 11 d6 8f |o.o)*?=`.-.p2...|
+| 53 2f 63 00 df 35 66 aa 05 26 c4 73 e1 e7 c1 66 |S/c..5f..&.s...f|
+| bb 83 af 48 01 ce 66 3e 86 b5 3b f1 03 a8 4a ee |...H..f>..;...J.|
+Plaintext[48]:
+| 04 8d 47 99 f6 c6 51 e9 14 00 00 0c 86 a0 09 a7 |..G...Q.........|
+| 63 20 e5 45 ce a1 b0 c4 0c 6c 24 37 23 01 f6 1b |c .E.....l$7#...|
+| 1b ec 75 00 f1 f9 68 7c 80 f9 05 e9 03 03 03 03 |..u...h|........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0c 6c 24 37 23 01 f6 1b 1b ec 75 00 f1 f9 68 7c |.l$7#.....u...h||
+| 80 f9 05 e9 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #129 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 57 5a bb df 56 b7 95 13 b8 52 24 19 87 27 41 70 |WZ..V....R$..'Ap|
+| 80 08 82 06 f5 87 04 c8 98 68 a7 f3 09 31 25 54 |.........h...1%T|
+| 02 a7 e2 97 aa 68 9e 83 4c b8 92 bd ac 4a b0 3a |.....h..L....J.:|
+Plaintext[48]:
+| a2 8a 9a c8 4b ad ce d8 14 00 00 0c d6 59 35 48 |....K........Y5H|
+| 87 91 96 c6 32 a3 f5 78 a9 9b 76 e7 db 00 80 1d |....2..x..v.....|
+| 7c b5 e1 2f 14 2a f6 48 50 42 ac a6 03 03 03 03 ||../.*.HPB......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a9 9b 76 e7 db 00 80 1d 7c b5 e1 2f 14 2a f6 48 |..v.....|../.*.H|
+| 50 42 ac a6 |PB.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #130 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| e5 84 cb 99 e7 f9 44 0a b0 d8 d3 17 dd ec 68 24 |......D.......h$|
+| 0e 0f c4 e6 32 1c af 92 bc 32 6c 1c 0a 2d cb 7d |....2....2l..-.}|
+| 9d 71 d1 e7 09 97 45 26 5d b7 e5 1d 04 18 a2 bd |.q....E&].......|
+| 40 c4 59 30 94 5e 83 44 93 91 73 7d 98 82 63 f5 |@.Y0.^.D..s}..c.|
+| 5a eb 5e 72 61 53 ba 9d 1f a5 ee dc 75 d2 dd 9e |Z.^raS......u...|
+| 75 8b c0 8b 65 d2 14 3d 62 3e a0 33 ee f9 91 0a |u...e..=b>.3....|
+| c2 79 bb 77 76 ad e0 15 |.y.wv... |
+Plaintext[104]:
+| 19 d0 53 1e 1a c7 a9 fd 47 45 54 20 2f 20 48 54 |..S.....GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 2d 73 |h-rsa-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 37 0d 0a |nsteyn.nl:4447..|
+| 0d 0a 38 f9 e5 e0 4d 34 89 b9 03 b0 8e a0 d0 da |..8...M4........|
+| 68 c2 8b ae 1f 40 01 01 |h....@.. |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 61 78 4a 36 22 9d 01 11 fd db 33 20 53 81 6c 56 |axJ6".....3 S.lV|
+| b1 2d 68 22 |.-h" |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34715 found (nil)
+association_find: TCP port 4447 found 0x3735030
+
+dissect_ssl enter frame #131 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c6 8f 12 cf 3b 1d 92 f0 14 4d 22 e0 fd 10 fa 3a |....;....M"....:|
+| 72 92 ba 37 17 54 bf c2 bb 13 28 f8 e4 e5 b9 b2 |r..7.T....(.....|
+| 5b d1 87 b0 db 86 53 20 91 6c 63 42 b9 5b 1e 49 |[.....S .lcB.[.I|
+| d7 ca 56 b5 f2 8a 72 34 2d cd d5 c8 c8 01 1a e1 |..V...r4-.......|
+| 3b 93 fb a2 30 82 b4 a0 84 55 af ca 9f b8 50 e0 |;...0....U....P.|
+| 6e 15 ab 74 f4 b7 a6 4f 1d 5d 9b e1 ec 69 2b db |n..t...O.]...i+.|
+| b9 28 67 5a d4 44 fc ce fc 19 b5 2e 33 9e 85 4e |.(gZ.D......3..N|
+| 49 85 ea 74 13 a7 37 f1 4d c9 44 d7 30 3a 94 08 |I..t..7.M.D.0:..|
+| 2c 66 86 2d 3e 7b 45 39 23 8b 36 cc fa 95 6e 98 |,f.->{E9#.6...n.|
+| a0 47 60 ca 07 f4 85 2d b4 42 4f 98 68 6e cc 33 |.G`....-.BO.hn.3|
+| 28 ed 94 49 05 e6 a1 ac 49 f8 b7 c7 58 5f 7b de |(..I....I...X_{.|
+| 32 4c 5f 2e b8 0f 06 75 97 77 9f fa f0 d3 5e 19 |2L_....u.w....^.|
+| 7e 7c a2 8f 14 7e 45 0d 48 3c 0f 53 7d d0 36 18 |~|...~E.H<.S}.6.|
+| 3c 10 20 d6 b6 b1 18 78 16 44 e0 e2 96 11 a6 cd |<. ....x.D......|
+| 24 47 79 85 8a 16 23 49 a4 94 e5 14 57 44 c2 aa |$Gy...#I....WD..|
+| c8 1b de 7c 41 e9 ea 52 b4 c9 e1 47 c7 fa 2b 40 |...|A..R...G..+@|
+| 5c 77 d5 1b ed d6 be d2 fa 15 1b a6 04 e4 3c 78 |\w............<x|
+| b6 52 91 48 e7 29 81 61 3f 77 d6 b5 aa 47 dd 40 |.R.H.).a?w...G.@|
+| 7a 51 b7 6f 4f 31 0d a3 8c 80 ff f7 9f c8 63 df |zQ.oO1........c.|
+| 24 5d fb 81 ed b1 ce e0 98 13 2b fc 11 98 dd 0e |$]........+.....|
+| b9 99 8a cb a4 ae 4b cc 25 71 cc 29 e3 bf a7 81 |......K.%q.)....|
+| 88 fd 34 14 f6 d1 36 31 89 ae ba ed 9b d8 81 4e |..4...61.......N|
+| ee 3d 97 8b 3f 60 9d f6 8c f4 d9 d6 0c ee 9d 40 |.=..?`.........@|
+| 87 0c 8c 02 2b 72 87 13 12 43 96 32 4c fe 26 67 |....+r...C.2L.&g|
+Plaintext[384]:
+| a9 68 90 28 ad 6e 65 5b 48 54 54 50 2f 31 2e 31 |.h.(.ne[HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 36 |che....0x00,0x16|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e ad 76 ed d1 f2 bb 4a f5 6b ea 36 15 |ipt>.v....J.k.6.|
+| 9c c2 59 6c fb 38 94 13 07 07 07 07 07 07 07 07 |..Yl.8..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 74 18 dc e1 0d a7 bf e5 2f ce 3d b1 32 9e 99 |.t......./.=.2..|
+| 78 1c 84 3e |x..> |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4447 found 0x3735030
+
+dissect_ssl enter frame #132 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| df f2 25 34 19 80 51 5c ce b1 36 14 a1 c4 cd e3 |..%4..Q\..6.....|
+| ac 62 ae 89 ed 5e ba 28 4b 2d 04 8c 01 48 ae bb |.b...^.(K-...H..|
+Plaintext[32]:
+| 05 21 f5 45 24 49 f0 e7 01 00 b5 b5 65 92 f5 19 |.!.E$I......e...|
+| ed e5 44 84 44 ed 2c f4 20 99 db c5 c0 26 01 01 |..D.D.,. ....&..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b5 b5 65 92 f5 19 ed e5 44 84 44 ed 2c f4 20 99 |..e.....D.D.,. .|
+| db c5 c0 26 |...& |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #134 (first time)
+ conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ca 52 f6 ed 92 4d 8d 4a 5b 18 ab 42 c1 a8 8c 0e |.R...M.J[..B....|
+| 96 2a 22 2a 12 7f ec e8 e3 7a 27 e7 c6 d6 f3 0f |.*"*.....z'.....|
+Plaintext[32]:
+| bf 88 bd fb b5 fc 8c 67 01 00 db 05 6c c7 2d 89 |.......g....l.-.|
+| 25 f1 a3 ae c6 5e f4 0f af 9e 09 8c 04 7b 01 01 |%....^.......{..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| db 05 6c c7 2d 89 25 f1 a3 ae c6 5e f4 0f af 9e |..l.-.%....^....|
+| 09 8c 04 7b |...{ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #139 (first time)
+ssl_session_init: initializing ptr 0x7fca45bdb9a0 size 688
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56670 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4448
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #141 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 32 1e ca 17 8e 72 c8 b6 cf 4d 06 65 12 1f 99 f5 |2....r...M.e....|
+| ec 24 8d 3a 1c 08 7c 2b d2 76 f4 fe de 48 88 e2 |.$.:..|+.v...H..|
+| cb 34 3c c8 44 4c 4c 30 aa eb 10 ab 43 66 c6 b4 |.4<.DLL0....Cf..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 ea c0 25 ba b0 72 a3 1d 4c 31 56 ff 06 22 66 |...%..r..L1V.."f|
+| 39 d0 19 87 9b 3e c7 46 f5 08 43 e2 b8 52 34 c2 |9....>.F..C..R4.|
+| f0 fe d3 fb db 79 78 42 dc 68 32 6e c3 42 fa da |.....yxB.h2n.B..|
+| 96 d5 07 5b 9e cc c8 b2 ba a6 2a 3b c5 |...[......*;. |
+hash out[104]:
+| 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z|
+| 1c 46 03 7d a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 |.F.}.....uon;..G|
+| 5e 3a 47 8b 6e 24 6f 3f 25 91 2b 98 d9 c6 f8 c8 |^:G.n$o?%.+.....|
+| 84 e7 95 41 e6 ab 4b 27 98 51 38 e0 d8 6c 99 58 |...A..K'.Q8..l.X|
+| d1 3d 6b f9 20 ff 86 06 dd dd 06 c8 63 ec ad da |.=k. .......c...|
+| c5 44 94 b4 04 e8 bb 78 2d 04 da 06 eb bd 9e 36 |.D.....x-......6|
+| 69 25 59 2a 52 83 c9 ce |i%Y*R... |
+PRF out[104]:
+| 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z|
+| 1c 46 03 7d a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 |.F.}.....uon;..G|
+| 5e 3a 47 8b 6e 24 6f 3f 25 91 2b 98 d9 c6 f8 c8 |^:G.n$o?%.+.....|
+| 84 e7 95 41 e6 ab 4b 27 98 51 38 e0 d8 6c 99 58 |...A..K'.Q8..l.X|
+| d1 3d 6b f9 20 ff 86 06 dd dd 06 c8 63 ec ad da |.=k. .......c...|
+| c5 44 94 b4 04 e8 bb 78 2d 04 da 06 eb bd 9e 36 |.D.....x-......6|
+| 69 25 59 2a 52 83 c9 ce |i%Y*R... |
+key expansion[104]:
+| 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z|
+| 1c 46 03 7d a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 |.F.}.....uon;..G|
+| 5e 3a 47 8b 6e 24 6f 3f 25 91 2b 98 d9 c6 f8 c8 |^:G.n$o?%.+.....|
+| 84 e7 95 41 e6 ab 4b 27 98 51 38 e0 d8 6c 99 58 |...A..K'.Q8..l.X|
+| d1 3d 6b f9 20 ff 86 06 dd dd 06 c8 63 ec ad da |.=k. .......c...|
+| c5 44 94 b4 04 e8 bb 78 2d 04 da 06 eb bd 9e 36 |.D.....x-......6|
+| 69 25 59 2a 52 83 c9 ce |i%Y*R... |
+Client MAC key[20]:
+| 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z|
+| 1c 46 03 7d |.F.} |
+Server MAC key[20]:
+| a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 5e 3a 47 8b |.....uon;..G^:G.|
+| 6e 24 6f 3f |n$o? |
+Client Write key[16]:
+| 25 91 2b 98 d9 c6 f8 c8 84 e7 95 41 e6 ab 4b 27 |%.+........A..K'|
+Server Write key[16]:
+| 98 51 38 e0 d8 6c 99 58 d1 3d 6b f9 20 ff 86 06 |.Q8..l.X.=k. ...|
+Client Write IV[16]:
+| dd dd 06 c8 63 ec ad da c5 44 94 b4 04 e8 bb 78 |....c....D.....x|
+Server Write IV[16]:
+| 2d 04 da 06 eb bd 9e 36 69 25 59 2a 52 83 c9 ce |-......6i%Y*R...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #143 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9e...
+looking for RSA pre-master5715e1b63101862a068c7d7829f47237593d876dc98e895f...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 00 06 42 33 89 8d 6f a2 b7 f2 ab a6 3b c9 69 c2 |..B3..o.....;.i.|
+| c8 26 4d d9 79 cd 8b fa 53 51 de 37 a2 e1 e9 ab |.&M.y...SQ.7....|
+| 33 2d e8 9d 9f b3 0f a2 38 c0 5f 2f a2 af 81 0c |3-......8._/....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 ea c0 25 ba b0 72 a3 1d 4c 31 56 ff 06 22 66 |...%..r..L1V.."f|
+| 39 d0 19 87 9b 3e c7 46 f5 08 43 e2 b8 52 34 c2 |9....>.F..C..R4.|
+| f0 fe d3 fb db 79 78 42 dc 68 32 6e c3 42 fa da |.....yxB.h2n.B..|
+| 96 d5 07 5b 9e cc c8 b2 ba a6 2a 3b c5 |...[......*;. |
+hash out[104]:
+| 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8|
+| da b2 a5 86 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 |....OF....M..x..|
+| 24 b4 30 e9 0c 32 7e f8 2f 33 cf e9 78 41 fb 94 |$.0..2~./3..xA..|
+| 12 b2 0f 7d 59 b6 66 7d 78 ca cc b1 6d 16 fe 3f |...}Y.f}x...m..?|
+| c8 34 16 39 f0 60 e2 56 7c 8a c5 2e 2f 40 3b c1 |.4.9.`.V|.../@;.|
+| b2 8b a9 fb a1 c3 9b b6 87 cd fa a6 2b f0 1f 7a |............+..z|
+| a2 9f 8e 3a 04 60 8b 6b |...:.`.k |
+PRF out[104]:
+| 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8|
+| da b2 a5 86 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 |....OF....M..x..|
+| 24 b4 30 e9 0c 32 7e f8 2f 33 cf e9 78 41 fb 94 |$.0..2~./3..xA..|
+| 12 b2 0f 7d 59 b6 66 7d 78 ca cc b1 6d 16 fe 3f |...}Y.f}x...m..?|
+| c8 34 16 39 f0 60 e2 56 7c 8a c5 2e 2f 40 3b c1 |.4.9.`.V|.../@;.|
+| b2 8b a9 fb a1 c3 9b b6 87 cd fa a6 2b f0 1f 7a |............+..z|
+| a2 9f 8e 3a 04 60 8b 6b |...:.`.k |
+key expansion[104]:
+| 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8|
+| da b2 a5 86 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 |....OF....M..x..|
+| 24 b4 30 e9 0c 32 7e f8 2f 33 cf e9 78 41 fb 94 |$.0..2~./3..xA..|
+| 12 b2 0f 7d 59 b6 66 7d 78 ca cc b1 6d 16 fe 3f |...}Y.f}x...m..?|
+| c8 34 16 39 f0 60 e2 56 7c 8a c5 2e 2f 40 3b c1 |.4.9.`.V|.../@;.|
+| b2 8b a9 fb a1 c3 9b b6 87 cd fa a6 2b f0 1f 7a |............+..z|
+| a2 9f 8e 3a 04 60 8b 6b |...:.`.k |
+Client MAC key[20]:
+| 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8|
+| da b2 a5 86 |.... |
+Server MAC key[20]:
+| 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 24 b4 30 e9 |OF....M..x..$.0.|
+| 0c 32 7e f8 |.2~. |
+Client Write key[16]:
+| 2f 33 cf e9 78 41 fb 94 12 b2 0f 7d 59 b6 66 7d |/3..xA.....}Y.f}|
+Server Write key[16]:
+| 78 ca cc b1 6d 16 fe 3f c8 34 16 39 f0 60 e2 56 |x...m..?.4.9.`.V|
+Client Write IV[16]:
+| 7c 8a c5 2e 2f 40 3b c1 b2 8b a9 fb a1 c3 9b b6 ||.../@;.........|
+Server Write IV[16]:
+| 87 cd fa a6 2b f0 1f 7a a2 9f 8e 3a 04 60 8b 6b |....+..z...:.`.k|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 00 06 42 33 89 8d 6f a2 b7 f2 ab a6 3b c9 69 c2 |..B3..o.....;.i.|
+| c8 26 4d d9 79 cd 8b fa 53 51 de 37 a2 e1 e9 ab |.&M.y...SQ.7....|
+| 33 2d e8 9d 9f b3 0f a2 38 c0 5f 2f a2 af 81 0c |3-......8._/....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cc 97 2f 88 0c c6 9a 61 40 f9 15 5d 02 b8 42 bf |../....a@..]..B.|
+| ac 06 ba d7 6d b8 7a c0 9e 2f e5 90 c7 af 9d 46 |....m.z../.....F|
+| 82 5b 46 c9 8c fb cd 53 07 fd cc d2 88 06 a2 1b |.[F....S........|
+| 0f 7f 47 69 e2 c0 a8 1b 02 b9 95 1e 9e a3 c1 26 |..Gi...........&|
+Plaintext[64]:
+| 2d a2 40 de 81 24 be 00 e3 ac 84 1a a7 55 fa 64 |-.@..$.......U.d|
+| 14 00 00 0c 2b 8c 3a 60 0a 9e 4e 40 94 20 43 cb |....+.:`..N@. C.|
+| bb 28 16 a5 2a 51 a2 0c a4 a1 35 98 22 43 48 6b |.(..*Q....5."CHk|
+| 62 a7 f6 46 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |b..F............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bb 28 16 a5 2a 51 a2 0c a4 a1 35 98 22 43 48 6b |.(..*Q....5."CHk|
+| 62 a7 f6 46 |b..F |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #144 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 95 08 ba 9a d0 3f 32 94 0e fa cf 42 9e 41 a3 ab |.....?2....B.A..|
+| 15 ad 59 09 bc 6b ef 56 3a 2e 88 be 1b d1 ef 28 |..Y..k.V:......(|
+| 4c 69 ea d1 c7 fd 02 e0 9d ce f0 22 79 27 81 8a |Li........."y'..|
+| a2 ed 5e 38 dd 45 3e 2b 24 a4 8b 75 8e 0c e3 a9 |..^8.E>+$..u....|
+Plaintext[64]:
+| 35 82 d2 e6 55 61 92 49 0e 7e 7d 51 48 f2 6f 30 |5...Ua.I.~}QH.o0|
+| 14 00 00 0c 0e c4 58 bd a7 03 6e 09 3e 36 1f 58 |......X...n.>6.X|
+| ec 7d a8 6f 33 2e 6d 96 80 8a 4a 92 d6 80 fd 24 |.}.o3.m...J....$|
+| b5 2c 98 f1 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ec 7d a8 6f 33 2e 6d 96 80 8a 4a 92 d6 80 fd 24 |.}.o3.m...J....$|
+| b5 2c 98 f1 |.,.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #145 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| b5 40 c2 ad ff e8 5b 3e ac 30 b0 5a 33 ea 4b 28 |.@....[>.0.Z3.K(|
+| 14 17 7d 91 2f df 66 5a 65 17 ed f9 9d 14 97 51 |..}./.fZe......Q|
+| d7 5c a0 01 53 38 af 5c d6 0b a5 36 90 7c b5 bc |.\..S8.\...6.|..|
+| 77 1f 1f 50 06 f1 2c 3f b7 d0 c2 3e e0 f8 0a 9c |w..P..,?...>....|
+| 5d a0 b8 e4 2a 69 4b 24 ef 50 cd 3b 4c cb 2d cb |]...*iK$.P.;L.-.|
+| 40 b2 37 93 d9 80 85 c4 30 e6 be 10 1a 98 01 dd |@.7.....0.......|
+| b5 59 12 84 50 90 26 d3 ea 56 d6 dd 89 74 01 59 |.Y..P.&..V...t.Y|
+Plaintext[112]:
+| 34 13 d8 83 04 73 d4 60 3d ae a1 14 43 26 22 c7 |4....s.`=...C&".|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....|
+| b7 4a 25 73 9f 8a d9 84 d3 ad 50 78 44 50 c4 8a |.J%s......PxDP..|
+| 35 3f 50 41 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |5?PA............|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fc 02 9f 30 cd e9 20 80 e7 fe 54 67 a3 5c 98 2e |...0.. ...Tg.\..|
+| b0 21 c2 70 |.!.p |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56670 found (nil)
+association_find: TCP port 4448 found 0x37350c0
+
+dissect_ssl enter frame #146 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| ee b9 cf 97 ac 01 e0 aa 04 3f 8d c8 41 a3 7a 51 |.........?..A.zQ|
+| b9 29 6d fd 78 f5 29 00 69 44 27 ba 85 fc 08 cd |.)m.x.).iD'.....|
+| b7 a6 90 f6 5c fd 51 a6 2e 26 a5 b2 ed 32 8f f4 |....\.Q..&...2..|
+| 38 b6 e5 55 36 d0 5f 2e 99 8a 78 05 a4 67 dd f8 |8..U6._...x..g..|
+| 27 f1 6f 8b 6d ff 10 6e f7 19 4b 07 4f 47 56 05 |'.o.m..n..K.OGV.|
+| 0f c0 28 b9 24 75 13 62 eb 93 03 15 0c cb 22 41 |..(.$u.b......"A|
+| 4f 8c ce c5 58 0e 44 76 ab 34 f6 e8 df 70 e6 41 |O...X.Dv.4...p.A|
+| aa de ab 50 75 21 a9 74 12 87 13 a4 b0 ae b8 de |...Pu!.t........|
+| f3 b1 46 08 c0 d2 8e 43 90 79 35 80 98 63 e9 54 |..F....C.y5..c.T|
+| 3f 18 cf c3 dd a5 25 ba ba 9f 88 b2 44 69 71 e7 |?.....%.....Diq.|
+| 14 ed 6c bf e2 53 7e 4d d2 ac 04 29 5e 42 4d 94 |..l..S~M...)^BM.|
+| 8b 37 2e 51 7e 9d 45 44 99 93 1c b3 2a 91 82 78 |.7.Q~.ED....*..x|
+| c1 5d 1e 29 f3 52 39 4e 2e 80 4f b2 67 0d 3b c7 |.].).R9N..O.g.;.|
+| ed 83 5a 36 21 6e 1a ad 8c 8d da 3e 14 af fa df |..Z6!n.....>....|
+| a8 c4 48 69 3d 00 df c2 ba 41 f5 1b 77 4f 5b 83 |..Hi=....A..wO[.|
+| 75 ce e5 1a 73 63 ff 8a 26 63 5e a1 30 f4 5b e5 |u...sc..&c^.0.[.|
+| 55 53 91 eb ce 8c cc 4a 00 cb d0 8b f8 df 2b 65 |US.....J......+e|
+| 4e a3 bc b0 f5 62 08 28 41 3a 33 5c 3d 22 a7 a0 |N....b.(A:3\="..|
+| 51 24 3a 74 89 d2 b3 2e 5b 42 fc 8c 78 31 a4 10 |Q$:t....[B..x1..|
+| be de 8e 8d 3e 2d 41 29 e3 4f fa a3 b0 5d 8d e8 |....>-A).O...]..|
+| a1 b0 41 b5 c1 1a fb a5 d7 ec 45 29 75 07 df d6 |..A.......E)u...|
+| e1 3b 43 99 6d d7 1e 5e 34 a6 63 dd 25 d0 7d b2 |.;C.m..^4.c.%.}.|
+| 5d c0 60 bc f9 de 3c be 3a 91 e1 11 d0 66 d6 43 |].`...<.:....f.C|
+| cb bd 97 44 40 09 6e dd 74 69 4c b4 de fd c0 c9 |...D@.n.tiL.....|
+| 99 f0 8c 99 f0 ef 4e c8 3a 5a 43 95 c7 ab 80 3c |......N.:ZC....<|
+Plaintext[400]:
+| 77 27 ba 54 67 62 9d b3 c4 55 ff cd c6 7c 62 6c |w'.Tgb...U...|bl|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12|
+| 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d5 0d a5 91 |nl'</script>....|
+| 38 ac 03 86 9f eb 34 0a 8b 68 a9 60 03 e2 02 1c |8.....4..h.`....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1f 43 f7 05 28 47 61 35 51 75 f6 34 b0 89 aa d6 |.C..(Ga5Qu.4....|
+| c0 ec 56 a1 |..V. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4448 found 0x37350c0
+
+dissect_ssl enter frame #147 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ad b6 f3 64 9e 66 61 18 73 71 52 f3 a6 48 09 ef |...d.fa.sqR..H..|
+| df da 12 13 0e 48 35 71 a3 c2 fe 09 25 eb e6 1a |.....H5q....%...|
+| 61 66 5d 3b a7 16 15 65 56 c3 43 00 6e bb d7 06 |af];...eV.C.n...|
+Plaintext[48]:
+| 77 b6 52 0a 47 fd f0 53 e4 56 3c c6 a1 cf 61 77 |w.R.G..S.V<...aw|
+| 01 00 c0 bc 03 af c0 0a 2c 5c 06 c3 2f 67 9e e5 |........,\../g..|
+| f5 9e 5c 20 38 35 09 09 09 09 09 09 09 09 09 09 |..\ 85..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c0 bc 03 af c0 0a 2c 5c 06 c3 2f 67 9e e5 f5 9e |......,\../g....|
+| 5c 20 38 35 |\ 85 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #149 (first time)
+ conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 08 d4 80 0e 80 f2 29 02 19 bf 60 c4 f4 38 fa de |......)...`..8..|
+| c7 b5 11 a7 ab 97 dc ce bb ff 7c 4d 93 e6 5c 75 |..........|M..\u|
+| a3 db 13 60 82 81 d8 f6 32 16 4b 1e de bd b2 6d |...`....2.K....m|
+Plaintext[48]:
+| 58 e0 ed 94 0d ad 44 83 f3 25 ea 86 53 e4 7a fa |X.....D..%..S.z.|
+| 01 00 29 ae 9f 0d fd 47 b1 56 0a 9e d8 dd db 6b |..)....G.V.....k|
+| ce 8e 56 69 19 56 09 09 09 09 09 09 09 09 09 09 |..Vi.V..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 29 ae 9f 0d fd 47 b1 56 0a 9e d8 dd db 6b ce 8e |)....G.V.....k..|
+| 56 69 19 56 |Vi.V |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #154 (first time)
+ssl_session_init: initializing ptr 0x7fca45bddf20 size 688
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35259 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4449
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #156 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 00 06 42 33 89 8d 6f a2 b7 f2 ab a6 3b c9 69 c2 |..B3..o.....;.i.|
+| c8 26 4d d9 79 cd 8b fa 53 51 de 37 a2 e1 e9 ab |.&M.y...SQ.7....|
+| 33 2d e8 9d 9f b3 0f a2 38 c0 5f 2f a2 af 81 0c |3-......8._/....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 1f 1d b5 2a 59 3d 17 d1 43 69 a5 83 a8 f3 d6 |....*Y=..Ci.....|
+| c6 b4 7f ad f0 51 3e 64 2e 89 5c b2 1f 52 34 c2 |.....Q>d..\..R4.|
+| f0 65 c9 d0 ed cc 01 45 d3 86 f0 4d 14 5a 87 cd |.e.....E...M.Z..|
+| be c2 12 07 0b e8 bc 2d 4f 17 35 ab 34 |.......-O.5.4 |
+hash out[104]:
+| 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...|
+| 52 a3 60 45 b2 81 90 cc c6 77 21 96 0a 22 fa b3 |R.`E.....w!.."..|
+| 57 a9 6e 5b bf 25 1d 51 1f 6f 01 49 94 cd ec ee |W.n[.%.Q.o.I....|
+| 5c 9f e4 3a ba 30 fc dd ee 00 00 bf 1a 61 0c 1c |\..:.0.......a..|
+| 45 25 05 33 e5 4b 17 54 35 fd fc 48 b9 5f e6 0a |E%.3.K.T5..H._..|
+| 5a d6 0f 56 92 46 5e 50 53 d1 37 64 a6 2e 56 f7 |Z..V.F^PS.7d..V.|
+| 60 d6 61 ae 08 eb cd 7e |`.a....~ |
+PRF out[104]:
+| 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...|
+| 52 a3 60 45 b2 81 90 cc c6 77 21 96 0a 22 fa b3 |R.`E.....w!.."..|
+| 57 a9 6e 5b bf 25 1d 51 1f 6f 01 49 94 cd ec ee |W.n[.%.Q.o.I....|
+| 5c 9f e4 3a ba 30 fc dd ee 00 00 bf 1a 61 0c 1c |\..:.0.......a..|
+| 45 25 05 33 e5 4b 17 54 35 fd fc 48 b9 5f e6 0a |E%.3.K.T5..H._..|
+| 5a d6 0f 56 92 46 5e 50 53 d1 37 64 a6 2e 56 f7 |Z..V.F^PS.7d..V.|
+| 60 d6 61 ae 08 eb cd 7e |`.a....~ |
+key expansion[104]:
+| 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...|
+| 52 a3 60 45 b2 81 90 cc c6 77 21 96 0a 22 fa b3 |R.`E.....w!.."..|
+| 57 a9 6e 5b bf 25 1d 51 1f 6f 01 49 94 cd ec ee |W.n[.%.Q.o.I....|
+| 5c 9f e4 3a ba 30 fc dd ee 00 00 bf 1a 61 0c 1c |\..:.0.......a..|
+| 45 25 05 33 e5 4b 17 54 35 fd fc 48 b9 5f e6 0a |E%.3.K.T5..H._..|
+| 5a d6 0f 56 92 46 5e 50 53 d1 37 64 a6 2e 56 f7 |Z..V.F^PS.7d..V.|
+| 60 d6 61 ae 08 eb cd 7e |`.a....~ |
+Client MAC key[20]:
+| 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...|
+| 52 a3 60 45 |R.`E |
+Server MAC key[20]:
+| b2 81 90 cc c6 77 21 96 0a 22 fa b3 57 a9 6e 5b |.....w!.."..W.n[|
+| bf 25 1d 51 |.%.Q |
+Client Write key[16]:
+| 1f 6f 01 49 94 cd ec ee 5c 9f e4 3a ba 30 fc dd |.o.I....\..:.0..|
+Server Write key[16]:
+| ee 00 00 bf 1a 61 0c 1c 45 25 05 33 e5 4b 17 54 |.....a..E%.3.K.T|
+Client Write IV[16]:
+| 35 fd fc 48 b9 5f e6 0a 5a d6 0f 56 92 46 5e 50 |5..H._..Z..V.F^P|
+Server Write IV[16]:
+| 53 d1 37 64 a6 2e 56 f7 60 d6 61 ae 08 eb cd 7e |S.7d..V.`.a....~|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #158 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070b...
+looking for RSA pre-master008086b58ca89b01c6f37d92bf892be5f5dbf620f6e6c18a...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 2c 59 cb fc dd b9 aa 12 0a 82 e8 e8 62 87 e9 |.,Y..........b..|
+| 60 fe 1a 1f 8e dd b4 8b b0 b7 09 8a 39 98 30 44 |`...........9.0D|
+| dc fd 3e e8 0c fd 93 87 1f 60 11 b3 9b 08 4d d4 |..>......`....M.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 1f 1d b5 2a 59 3d 17 d1 43 69 a5 83 a8 f3 d6 |....*Y=..Ci.....|
+| c6 b4 7f ad f0 51 3e 64 2e 89 5c b2 1f 52 34 c2 |.....Q>d..\..R4.|
+| f0 65 c9 d0 ed cc 01 45 d3 86 f0 4d 14 5a 87 cd |.e.....E...M.Z..|
+| be c2 12 07 0b e8 bc 2d 4f 17 35 ab 34 |.......-O.5.4 |
+hash out[104]:
+| 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B|
+| de d9 bd c1 f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 |........z..(U...|
+| 3e 8a bc 68 c1 b7 5c bc a6 5a 24 57 6d f8 9d 26 |>..h..\..Z$Wm..&|
+| 5d 7e 56 3e 28 b2 03 a0 63 1f 93 0d bc 51 ec 55 |]~V>(...c....Q.U|
+| a4 67 26 91 d6 62 48 2b ee f3 d3 1c e6 82 cc fe |.g&..bH+........|
+| 50 10 ed 1a b9 0a f9 97 56 d7 10 54 13 e1 9b f1 |P.......V..T....|
+| 12 62 54 88 c9 18 ea b0 |.bT..... |
+PRF out[104]:
+| 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B|
+| de d9 bd c1 f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 |........z..(U...|
+| 3e 8a bc 68 c1 b7 5c bc a6 5a 24 57 6d f8 9d 26 |>..h..\..Z$Wm..&|
+| 5d 7e 56 3e 28 b2 03 a0 63 1f 93 0d bc 51 ec 55 |]~V>(...c....Q.U|
+| a4 67 26 91 d6 62 48 2b ee f3 d3 1c e6 82 cc fe |.g&..bH+........|
+| 50 10 ed 1a b9 0a f9 97 56 d7 10 54 13 e1 9b f1 |P.......V..T....|
+| 12 62 54 88 c9 18 ea b0 |.bT..... |
+key expansion[104]:
+| 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B|
+| de d9 bd c1 f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 |........z..(U...|
+| 3e 8a bc 68 c1 b7 5c bc a6 5a 24 57 6d f8 9d 26 |>..h..\..Z$Wm..&|
+| 5d 7e 56 3e 28 b2 03 a0 63 1f 93 0d bc 51 ec 55 |]~V>(...c....Q.U|
+| a4 67 26 91 d6 62 48 2b ee f3 d3 1c e6 82 cc fe |.g&..bH+........|
+| 50 10 ed 1a b9 0a f9 97 56 d7 10 54 13 e1 9b f1 |P.......V..T....|
+| 12 62 54 88 c9 18 ea b0 |.bT..... |
+Client MAC key[20]:
+| 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B|
+| de d9 bd c1 |.... |
+Server MAC key[20]:
+| f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 3e 8a bc 68 |....z..(U...>..h|
+| c1 b7 5c bc |..\. |
+Client Write key[16]:
+| a6 5a 24 57 6d f8 9d 26 5d 7e 56 3e 28 b2 03 a0 |.Z$Wm..&]~V>(...|
+Server Write key[16]:
+| 63 1f 93 0d bc 51 ec 55 a4 67 26 91 d6 62 48 2b |c....Q.U.g&..bH+|
+Client Write IV[16]:
+| ee f3 d3 1c e6 82 cc fe 50 10 ed 1a b9 0a f9 97 |........P.......|
+Server Write IV[16]:
+| 56 d7 10 54 13 e1 9b f1 12 62 54 88 c9 18 ea b0 |V..T.....bT.....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 8e 2c 59 cb fc dd b9 aa 12 0a 82 e8 e8 62 87 e9 |.,Y..........b..|
+| 60 fe 1a 1f 8e dd b4 8b b0 b7 09 8a 39 98 30 44 |`...........9.0D|
+| dc fd 3e e8 0c fd 93 87 1f 60 11 b3 9b 08 4d d4 |..>......`....M.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 35 c3 d4 dc 5e 54 70 4a e2 41 19 df 96 0e c5 99 |5...^TpJ.A......|
+| e0 6e 2c c6 c9 c7 6b f4 01 e8 8c 3e ba 7f 1e 1c |.n,...k....>....|
+| c3 25 e4 b0 00 33 da 40 f0 9e ec d8 7c 56 30 93 |.%...3.@....|V0.|
+| 26 a9 0b 5a e4 b4 92 b0 75 5d ed 30 ee 3d f3 54 |&..Z....u].0.=.T|
+Plaintext[64]:
+| f5 76 15 09 b2 31 ce 5a e2 c3 7c 6d 3d 9a d7 7c |.v...1.Z..|m=..||
+| 14 00 00 0c cd c3 70 bd 14 27 7c 65 86 7d 8f 63 |......p..'|e.}.c|
+| ab fa cb 5c 49 83 83 0d 37 47 ef 46 1e d5 a6 87 |...\I...7G.F....|
+| bd b0 5c c7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..\.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ab fa cb 5c 49 83 83 0d 37 47 ef 46 1e d5 a6 87 |...\I...7G.F....|
+| bd b0 5c c7 |..\. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #159 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| e6 a0 d6 e1 23 3d 99 fc 78 33 a5 3e 95 37 df 71 |....#=..x3.>.7.q|
+| 24 85 08 b0 b4 cc e7 0b e7 ad 84 9b 5d bd 74 3d |$...........].t=|
+| a5 2b 53 f4 79 92 43 54 9a 42 4a 67 cf 9e c1 8b |.+S.y.CT.BJg....|
+| 53 25 25 ee 5e 18 e1 b2 4e b0 36 4b 06 a7 23 80 |S%%.^...N.6K..#.|
+Plaintext[64]:
+| 91 b5 f4 12 fa a6 91 cb 42 30 d9 46 eb 87 33 21 |........B0.F..3!|
+| 14 00 00 0c e9 bf bc 3a 2d 98 02 15 37 91 32 b2 |.......:-...7.2.|
+| 29 e1 9d e3 ff 87 58 a3 be 32 2e 8b 81 34 7e 2a |).....X..2...4~*|
+| 4f 5e e5 5b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |O^.[............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 29 e1 9d e3 ff 87 58 a3 be 32 2e 8b 81 34 7e 2a |).....X..2...4~*|
+| 4f 5e e5 5b |O^.[ |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #160 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 64 0a 93 bc f2 ec 00 87 89 2c 15 d0 39 66 94 3b |d........,..9f.;|
+| 30 a7 79 c6 4d 34 06 5d 10 be 50 69 d4 13 e6 cb |0.y.M4.]..Pi....|
+| f9 a7 69 30 94 19 a3 e8 cd 80 a2 b0 31 ee 95 2c |..i0........1..,|
+| 5a 32 0b 59 5c ee 8e 6c 10 3c 91 d3 4d e4 09 c7 |Z2.Y\..l.<..M...|
+| 10 35 b5 f8 ec 68 68 59 58 d6 80 ba fe 79 b8 26 |.5...hhYX....y.&|
+| eb 8f 96 3a f4 44 08 52 47 11 2c 90 4f 12 b8 36 |...:.D.RG.,.O..6|
+| 16 b8 da 8c e2 da 68 2c 02 ab b4 73 4c 68 55 6e |......h,...sLhUn|
+Plaintext[112]:
+| 3f e2 27 19 52 28 7a 35 ee cb fe d6 f8 d9 d7 50 |?.'.R(z5.......P|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 34 39 0d 0a 0d 0a 95 4e f3 47 20 08 71 19 |4449.....N.G .q.|
+| c1 26 1b 6c 38 7c b4 23 0a 36 ff 84 03 03 03 03 |.&.l8|.#.6......|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c8 3f 70 ec 90 82 20 ae 46 4e 9c 30 72 2a 8a 7e |.?p... .FN.0r*.~|
+| 7e c6 2f 27 |~./' |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35259 found (nil)
+association_find: TCP port 4449 found 0x3735150
+
+dissect_ssl enter frame #161 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| b2 99 0a 09 7c 79 83 84 d3 eb ac 71 64 0b 42 a3 |....|y.....qd.B.|
+| 68 a8 d0 57 7f f0 fb f4 cd 82 3d 24 d8 55 eb 80 |h..W......=$.U..|
+| b2 c0 f0 61 d9 46 25 53 fc 2a c3 7f 24 c0 a9 ca |...a.F%S.*..$...|
+| ee 3d b7 20 0b f4 a8 8c 1b e3 6b 12 7f 4e 40 5a |.=. ......k..N@Z|
+| 36 d3 4d 2f 3a fa 8f 05 4e c9 2c 79 28 54 c3 80 |6.M/:...N.,y(T..|
+| 99 0f cf b0 5a 17 87 d1 bd b0 74 2e 24 72 54 1a |....Z.....t.$rT.|
+| ae 29 cb f7 fb b8 3e 86 71 32 c1 e5 ab f5 23 14 |.)....>.q2....#.|
+| 82 71 cf 42 8e 20 41 ef b1 67 6a 6c 39 9d 46 71 |.q.B. A..gjl9.Fq|
+| 49 0f dd 57 06 fc ba 1a 7f a2 7e c9 a3 cf 36 d3 |I..W......~...6.|
+| f4 52 62 70 c2 86 11 ca 68 09 94 03 ed 21 54 fe |.Rbp....h....!T.|
+| c2 36 5e 72 7e 45 6d 9a 50 11 ee 7d 0c d5 5b 86 |.6^r~Em.P..}..[.|
+| cf 64 dc 8d 65 f4 be 89 ea 7e e1 78 a9 2f 3b 82 |.d..e....~.x./;.|
+| c4 d6 a4 25 68 9d d7 57 8d ef 4d bc 39 80 0f c7 |...%h..W..M.9...|
+| d6 61 d3 27 8e ac c8 ff 71 05 7b 25 72 fe fc 88 |.a.'....q.{%r...|
+| eb b5 a1 8d fc 99 84 df 11 82 99 a4 94 11 8e a3 |................|
+| 56 f6 03 a9 2d 32 1f ba 3b e5 54 e4 ec 6b 84 a5 |V...-2..;.T..k..|
+| 25 77 f4 08 f9 c8 4a 10 60 fc e2 b0 3c d6 91 75 |%w....J.`...<..u|
+| d9 bc 06 9c 79 a6 26 2c 15 46 73 2c f2 85 38 c4 |....y.&,.Fs,..8.|
+| 2c 81 dc a4 e9 11 b4 56 0d ff 21 54 e4 67 28 4e |,......V..!T.g(N|
+| d2 7f 69 d4 04 e0 49 66 7f 7d d7 0b e8 f7 4d 37 |..i...If.}....M7|
+| 7f 71 88 cb 15 7f 39 d1 cc 4b df 7b 44 f1 47 48 |.q....9..K.{D.GH|
+| 07 70 d1 d6 a1 6b c5 b7 96 6e 3e 4b 63 6e b7 e3 |.p...k...n>Kcn..|
+| e1 5b a6 c0 ce 38 a0 8b 53 6c 50 4f cd 14 dc c5 |.[...8..SlPO....|
+| c5 7d ea a4 23 74 fd bc a9 69 df 05 a9 64 2a d8 |.}..#t...i...d*.|
+| 41 ee 2b 46 2b aa 60 c4 86 06 99 91 89 8e b3 f2 |A.+F+.`.........|
+Plaintext[400]:
+| 0b 59 e6 9b f1 bf 02 ba 46 9a 9f c7 ed 33 59 49 |.Y......F....3YI|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D|
+| 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 96 43 e1 34 |nl'</script>.C.4|
+| 59 9e 24 1b bb 70 af 60 f4 8b b7 77 53 7a ee 5a |Y.$..p.`...wSz.Z|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c8 5b 70 f0 ab bd cb 32 b1 14 5c 5e bd 72 45 20 |.[p....2..\^.rE |
+| 97 56 64 b5 |.Vd. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4449 found 0x3735150
+
+dissect_ssl enter frame #162 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 39 e7 dd 4b 44 7e 7c b8 97 97 a6 58 26 f8 ba 7e |9..KD~|....X&..~|
+| 74 7d 46 37 fb 7b 55 a2 1a 11 de ff f6 d9 cc 9a |t}F7.{U.........|
+| 6b d4 75 02 e9 7d 49 e4 95 67 02 15 eb 7e 45 e7 |k.u..}I..g...~E.|
+Plaintext[48]:
+| 4f a1 ea f2 33 5d d2 77 82 83 3e 5a 79 03 38 da |O...3].w..>Zy.8.|
+| 01 00 74 1c d4 03 bf 8e 0f 6d 02 07 c5 57 81 24 |..t......m...W.$|
+| 11 d7 02 a0 ba f1 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 1c d4 03 bf 8e 0f 6d 02 07 c5 57 81 24 11 d7 |t......m...W.$..|
+| 02 a0 ba f1 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #164 (first time)
+ conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 5c 44 1a 80 fd 82 a7 29 ac 37 7d 81 fb 96 28 5b |\D.....).7}...([|
+| b1 e0 ce 8c fa e4 c9 65 cc 4d 95 f4 32 7f 6d fa |.......e.M..2.m.|
+| 5b 61 19 4d 52 3c d0 f2 a8 09 00 b8 c3 77 08 b4 |[a.MR<.......w..|
+Plaintext[48]:
+| da 7b 54 ca 06 67 79 b1 9e 46 c9 a4 2f 4f 1e 90 |.{T..gy..F../O..|
+| 01 00 f5 7f 65 97 0a 15 5d 95 15 51 18 b1 4f df |....e...]..Q..O.|
+| eb 56 34 54 00 34 09 09 09 09 09 09 09 09 09 09 |.V4T.4..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f5 7f 65 97 0a 15 5d 95 15 51 18 b1 4f df eb 56 |..e...]..Q..O..V|
+| 34 54 00 34 |4T.4 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #169 (first time)
+ssl_session_init: initializing ptr 0x7fca45be0420 size 688
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53479 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4450
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #171 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 2c 59 cb fc dd b9 aa 12 0a 82 e8 e8 62 87 e9 |.,Y..........b..|
+| 60 fe 1a 1f 8e dd b4 8b b0 b7 09 8a 39 98 30 44 |`...........9.0D|
+| dc fd 3e e8 0c fd 93 87 1f 60 11 b3 9b 08 4d d4 |..>......`....M.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 92 dd 25 76 9e f9 12 f0 9d 22 22 4f 83 c9 f8 |...%v.....""O...|
+| a1 89 06 ca 74 ac 16 4c 7a b6 c9 dc c5 52 34 c2 |....t..Lz....R4.|
+| f0 a9 0c 69 82 5f cd 60 f7 30 99 75 80 ca 86 83 |...i._.`.0.u....|
+| 00 8a b3 98 4a f9 69 f7 f5 1b 11 53 29 |....J.i....S) |
+hash out[104]:
+| df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.|
+| 26 d2 bf 18 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 |&...-..J...C...i|
+| 2f ef 30 67 1d a8 bf 51 44 1d ea 7d 24 82 9f b4 |/.0g...QD..}$...|
+| 51 e3 fe de dc 7d 0a ff c4 95 09 f2 61 3e a6 ab |Q....}......a>..|
+| 10 8c 58 e3 5d e3 9e b9 12 22 d7 32 a7 e6 96 08 |..X.]....".2....|
+| 40 d4 88 d7 fd 93 63 12 75 29 ab 48 34 e6 88 a7 |@.....c.u).H4...|
+| d7 a7 98 d2 07 8a 97 6a |.......j |
+PRF out[104]:
+| df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.|
+| 26 d2 bf 18 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 |&...-..J...C...i|
+| 2f ef 30 67 1d a8 bf 51 44 1d ea 7d 24 82 9f b4 |/.0g...QD..}$...|
+| 51 e3 fe de dc 7d 0a ff c4 95 09 f2 61 3e a6 ab |Q....}......a>..|
+| 10 8c 58 e3 5d e3 9e b9 12 22 d7 32 a7 e6 96 08 |..X.]....".2....|
+| 40 d4 88 d7 fd 93 63 12 75 29 ab 48 34 e6 88 a7 |@.....c.u).H4...|
+| d7 a7 98 d2 07 8a 97 6a |.......j |
+key expansion[104]:
+| df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.|
+| 26 d2 bf 18 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 |&...-..J...C...i|
+| 2f ef 30 67 1d a8 bf 51 44 1d ea 7d 24 82 9f b4 |/.0g...QD..}$...|
+| 51 e3 fe de dc 7d 0a ff c4 95 09 f2 61 3e a6 ab |Q....}......a>..|
+| 10 8c 58 e3 5d e3 9e b9 12 22 d7 32 a7 e6 96 08 |..X.]....".2....|
+| 40 d4 88 d7 fd 93 63 12 75 29 ab 48 34 e6 88 a7 |@.....c.u).H4...|
+| d7 a7 98 d2 07 8a 97 6a |.......j |
+Client MAC key[20]:
+| df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.|
+| 26 d2 bf 18 |&... |
+Server MAC key[20]:
+| 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 2f ef 30 67 |-..J...C...i/.0g|
+| 1d a8 bf 51 |...Q |
+Client Write key[16]:
+| 44 1d ea 7d 24 82 9f b4 51 e3 fe de dc 7d 0a ff |D..}$...Q....}..|
+Server Write key[16]:
+| c4 95 09 f2 61 3e a6 ab 10 8c 58 e3 5d e3 9e b9 |....a>....X.]...|
+Client Write IV[16]:
+| 12 22 d7 32 a7 e6 96 08 40 d4 88 d7 fd 93 63 12 |.".2....@.....c.|
+Server Write IV[16]:
+| 75 29 ab 48 34 e6 88 a7 d7 a7 98 d2 07 8a 97 6a |u).H4..........j|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #173 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984a...
+looking for RSA pre-master008087631ffaab6ac3c1eb4eb18287d48d7c0648ca2d79c1...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| db bb bf 65 08 47 e1 5a f8 07 fb 9d 25 e6 45 89 |...e.G.Z....%.E.|
+| 85 1a 41 ad 12 ac b5 f6 75 e1 db aa 92 5c 56 ed |..A.....u....\V.|
+| 2b 8a e8 0d cc 52 e5 ef d9 44 d0 64 78 8b 8d 87 |+....R...D.dx...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 92 dd 25 76 9e f9 12 f0 9d 22 22 4f 83 c9 f8 |...%v.....""O...|
+| a1 89 06 ca 74 ac 16 4c 7a b6 c9 dc c5 52 34 c2 |....t..Lz....R4.|
+| f0 a9 0c 69 82 5f cd 60 f7 30 99 75 80 ca 86 83 |...i._.`.0.u....|
+| 00 8a b3 98 4a f9 69 f7 f5 1b 11 53 29 |....J.i....S) |
+hash out[104]:
+| f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..|
+| 76 19 df c3 31 c7 20 0d f1 3d 70 25 63 3c c0 12 |v...1. ..=p%c<..|
+| 32 e5 b9 03 c3 13 2f f1 58 b7 51 ab ca f0 65 f7 |2...../.X.Q...e.|
+| a5 49 c4 e3 c6 ef a5 b0 04 b4 87 70 85 55 49 6a |.I.........p.UIj|
+| 89 a0 72 0a 1f 0c 42 30 c7 08 c8 a9 0d 90 b1 c2 |..r...B0........|
+| 1c 85 25 93 5b 8e 17 74 36 42 4e 37 32 4e 52 61 |..%.[..t6BN72NRa|
+| 38 47 1e 11 ab aa 8b 6a |8G.....j |
+PRF out[104]:
+| f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..|
+| 76 19 df c3 31 c7 20 0d f1 3d 70 25 63 3c c0 12 |v...1. ..=p%c<..|
+| 32 e5 b9 03 c3 13 2f f1 58 b7 51 ab ca f0 65 f7 |2...../.X.Q...e.|
+| a5 49 c4 e3 c6 ef a5 b0 04 b4 87 70 85 55 49 6a |.I.........p.UIj|
+| 89 a0 72 0a 1f 0c 42 30 c7 08 c8 a9 0d 90 b1 c2 |..r...B0........|
+| 1c 85 25 93 5b 8e 17 74 36 42 4e 37 32 4e 52 61 |..%.[..t6BN72NRa|
+| 38 47 1e 11 ab aa 8b 6a |8G.....j |
+key expansion[104]:
+| f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..|
+| 76 19 df c3 31 c7 20 0d f1 3d 70 25 63 3c c0 12 |v...1. ..=p%c<..|
+| 32 e5 b9 03 c3 13 2f f1 58 b7 51 ab ca f0 65 f7 |2...../.X.Q...e.|
+| a5 49 c4 e3 c6 ef a5 b0 04 b4 87 70 85 55 49 6a |.I.........p.UIj|
+| 89 a0 72 0a 1f 0c 42 30 c7 08 c8 a9 0d 90 b1 c2 |..r...B0........|
+| 1c 85 25 93 5b 8e 17 74 36 42 4e 37 32 4e 52 61 |..%.[..t6BN72NRa|
+| 38 47 1e 11 ab aa 8b 6a |8G.....j |
+Client MAC key[20]:
+| f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..|
+| 76 19 df c3 |v... |
+Server MAC key[20]:
+| 31 c7 20 0d f1 3d 70 25 63 3c c0 12 32 e5 b9 03 |1. ..=p%c<..2...|
+| c3 13 2f f1 |../. |
+Client Write key[16]:
+| 58 b7 51 ab ca f0 65 f7 a5 49 c4 e3 c6 ef a5 b0 |X.Q...e..I......|
+Server Write key[16]:
+| 04 b4 87 70 85 55 49 6a 89 a0 72 0a 1f 0c 42 30 |...p.UIj..r...B0|
+Client Write IV[16]:
+| c7 08 c8 a9 0d 90 b1 c2 1c 85 25 93 5b 8e 17 74 |..........%.[..t|
+Server Write IV[16]:
+| 36 42 4e 37 32 4e 52 61 38 47 1e 11 ab aa 8b 6a |6BN72NRa8G.....j|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| db bb bf 65 08 47 e1 5a f8 07 fb 9d 25 e6 45 89 |...e.G.Z....%.E.|
+| 85 1a 41 ad 12 ac b5 f6 75 e1 db aa 92 5c 56 ed |..A.....u....\V.|
+| 2b 8a e8 0d cc 52 e5 ef d9 44 d0 64 78 8b 8d 87 |+....R...D.dx...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 13 ce 7c 83 1d a5 60 ac 6c 56 39 ac d9 52 55 6b |..|...`.lV9..RUk|
+| 71 fb 68 ad 21 9b a5 4a df e2 f7 d5 bc da e3 1e |q.h.!..J........|
+| 3c 22 e7 37 58 e7 90 77 96 0b 76 21 6d 62 b4 0c |<".7X..w..v!mb..|
+| 91 ad 29 61 3e f2 f7 e4 3e 32 2d 5f 0a ad eb 6f |..)a>...>2-_...o|
+Plaintext[64]:
+| ee 92 8f 1e c7 ed f9 90 dd 3d 83 77 b1 40 87 e2 |.........=.w.@..|
+| 14 00 00 0c 36 f4 bf e0 5e bd 0d 05 7a a7 6c e6 |....6...^...z.l.|
+| ed d7 4f 68 4b a9 45 11 32 41 e8 d2 7e a9 94 f7 |..OhK.E.2A..~...|
+| 51 0b 33 3d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |Q.3=............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ed d7 4f 68 4b a9 45 11 32 41 e8 d2 7e a9 94 f7 |..OhK.E.2A..~...|
+| 51 0b 33 3d |Q.3= |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #174 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 36 3d 52 4f 3e ad f8 77 ff a0 77 8f 80 00 4a a9 |6=RO>..w..w...J.|
+| 63 06 f4 cf 69 47 a5 8e b2 84 04 5d fd bb 45 f9 |c...iG.....]..E.|
+| 9a 0a e5 b0 36 b0 29 f2 43 2f 8f 0d c7 66 d4 b0 |....6.).C/...f..|
+| dc 5c 43 a7 ce f9 cb 25 6a 9a 64 7b 60 26 6c 9a |.\C....%j.d{`&l.|
+Plaintext[64]:
+| a5 ed 50 75 4e 7f 5c 92 01 ee 0e 79 c1 27 9c 1a |..PuN.\....y.'..|
+| 14 00 00 0c 18 75 56 15 80 1c c1 48 f1 ef 6d 7d |.....uV....H..m}|
+| cc 1c 3b ce 22 92 63 43 ae c0 94 9d 9f 74 fb 74 |..;.".cC.....t.t|
+| d8 bd 02 d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc 1c 3b ce 22 92 63 43 ae c0 94 9d 9f 74 fb 74 |..;.".cC.....t.t|
+| d8 bd 02 d4 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #175 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 51 5b 83 11 9a 3e ab 1b 0c 00 e7 2c 5e c0 be 7a |Q[...>.....,^..z|
+| a0 32 b0 26 5f 53 4b 69 7b 87 a0 ce 63 3c f8 2b |.2.&_SKi{...c<.+|
+| bd 9f 5d 8c c3 ef be 26 7d 30 de b9 8f 59 1a 69 |..]....&}0...Y.i|
+| 2b 6d 6d 68 f1 97 4c 7b f2 12 b4 bb 15 ee 68 4c |+mmh..L{......hL|
+| 30 68 a9 d0 9b cd 31 6f 76 41 80 01 79 87 93 d8 |0h....1ovA..y...|
+| 1c 56 5f 80 e6 71 57 cd e4 32 4d 3b 62 8c 87 e4 |.V_..qW..2M;b...|
+| 8c 66 57 d6 5f 66 58 9b dd c0 77 db bc 6f 1a a9 |.fW._fX...w..o..|
+Plaintext[112]:
+| 1e 75 a8 8a fa 20 e1 0f 41 ab 20 1b cf 4f 28 6a |.u... ..A. ..O(j|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 30 0d 0a 0d 0a cf 5a ac 9a 4a 9a f9 f8 |4450.....Z..J...|
+| ac 76 48 0d 7a 72 73 41 57 b8 5e b4 03 03 03 03 |.vH.zrsAW.^.....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 92 f0 37 5c f3 f9 5c a6 e4 a1 97 eb e0 12 58 4b |..7\..\.......XK|
+| a6 35 a7 d4 |.5.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53479 found (nil)
+association_find: TCP port 4450 found 0x37351e0
+
+dissect_ssl enter frame #176 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 37 d1 68 79 fa cf 6d 47 82 bf 9b 70 bb a7 48 e3 |7.hy..mG...p..H.|
+| ff 45 93 8a b9 57 b5 bc 56 7a a3 af 80 45 78 17 |.E...W..Vz...Ex.|
+| 45 d1 14 b8 87 49 07 bc 36 7a ba 50 1e a9 a9 c2 |E....I..6z.P....|
+| 54 d1 79 43 c7 80 c0 19 fb 0e d1 61 a7 97 6e 8f |T.yC.......a..n.|
+| b9 6e da dc 26 6c f7 17 ce d0 4b fb cf 56 73 94 |.n..&l....K..Vs.|
+| e1 63 6e 3c 94 0b bd 61 c9 24 24 63 08 f6 b9 73 |.cn<...a.$$c...s|
+| bc 5c 90 20 ae 8e 7e fe bc c4 5b c3 05 33 49 3a |.\. ..~...[..3I:|
+| d1 5d 8d 10 6e 61 05 9f 7c 57 99 f1 0c 8e 4e fe |.]..na..|W....N.|
+| 93 1e 61 57 ab 7d 4f 0f 43 ac ee 51 9d 39 d7 8a |..aW.}O.C..Q.9..|
+| d7 ed 0d 63 1f bd 28 f3 a8 57 08 08 bc 64 54 47 |...c..(..W...dTG|
+| f8 58 fa 78 77 c0 f3 f8 8d 83 62 21 3e fc a2 3d |.X.xw.....b!>..=|
+| 6c ed 80 a8 35 ac ee e8 ba 09 88 d5 80 83 c9 ef |l...5...........|
+| 24 28 ad 02 ba 45 41 e1 75 d7 01 6e 58 0b 89 4f |$(...EA.u..nX..O|
+| c6 80 44 f5 71 bb 28 d7 4e 09 57 f6 d3 d2 b9 e6 |..D.q.(.N.W.....|
+| 09 2a 89 74 5d 73 e3 70 fc db b3 86 91 8c ab 9f |.*.t]s.p........|
+| 33 14 fa ee 87 b6 04 c6 e5 d9 bd 81 4a d4 b8 1b |3...........J...|
+| 66 8e 29 d3 5e 16 50 31 27 e6 47 91 9b ce 78 7d |f.).^.P1'.G...x}|
+| d4 5e 91 40 82 f7 30 ce ed 90 70 c9 62 76 41 c5 |.^.@..0...p.bvA.|
+| ff f7 b8 b9 be 80 f1 04 9a 76 1b 37 45 e8 23 40 |.........v.7E.#@|
+| 19 6f 36 20 85 51 48 14 47 a5 37 8e f7 e0 a6 08 |.o6 .QH.G.7.....|
+| af 1b 3d ee 1e 10 59 f5 70 44 b7 5e 67 fb 21 a9 |..=...Y.pD.^g.!.|
+| 8b 51 8a 33 a5 af 6b 07 18 b0 61 65 f7 6f 1e 36 |.Q.3..k...ae.o.6|
+| 5f 3b 45 aa 09 04 f8 51 27 ea 8c 27 9e b0 e4 dd |_;E....Q'..'....|
+| 6e 7a d7 31 68 72 40 98 da e6 50 5c 2f 01 18 fa |nz.1hr@...P\/...|
+| 7e 2a 66 01 09 c7 b4 e4 65 b9 46 b9 fd 1d 3d 3b |~*f.....e.F...=;|
+Plaintext[400]:
+| 00 22 89 ec f1 ff a6 17 c2 45 19 c2 ba 12 ed 66 |.".......E.....f|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R|
+| 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e c2 d1 45 96 |nl'</script>..E.|
+| 97 9a 98 91 41 9c 2f 31 7c 54 f4 90 bb d9 ab a2 |....A./1|T......|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 11 76 42 14 84 ab 07 2e 36 88 34 e6 50 6e a7 |..vB.....6.4.Pn.|
+| 41 c7 5e 57 |A.^W |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4450 found 0x37351e0
+
+dissect_ssl enter frame #177 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 14 d3 a7 a2 3d 20 2c 40 8d ee d3 8c 03 c8 49 c6 |....= ,@......I.|
+| 86 f3 9a 97 3a a8 fe 8a 14 25 3e ae 34 b9 46 bf |....:....%>.4.F.|
+| 23 5a f3 d0 00 9b 3a a4 d4 8c 88 c4 2e ac c0 94 |#Z....:.........|
+Plaintext[48]:
+| f1 87 00 95 a1 ef 7a 30 6c 93 76 59 53 96 79 79 |......z0l.vYS.yy|
+| 01 00 c9 7d 56 6e b6 89 b8 55 f4 df 89 bd b6 59 |...}Vn...U.....Y|
+| 8a 9d 82 35 85 ca 09 09 09 09 09 09 09 09 09 09 |...5............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c9 7d 56 6e b6 89 b8 55 f4 df 89 bd b6 59 8a 9d |.}Vn...U.....Y..|
+| 82 35 85 ca |.5.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #179 (first time)
+ conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c8 d9 a5 bd 0e 3d a2 ee 89 07 00 14 82 97 84 d9 |.....=..........|
+| 8e f3 c3 68 af 4b 0b b0 91 06 23 5a eb 1a e0 a8 |...h.K....#Z....|
+| 05 34 46 00 b8 14 76 50 75 fc 15 6b 24 f8 1c 86 |.4F...vPu..k$...|
+Plaintext[48]:
+| 43 1c b4 57 66 e4 d1 42 61 53 66 34 bd 34 34 50 |C..Wf..BaSf4.44P|
+| 01 00 31 fb 6f 51 66 33 c0 6d f0 66 0b 2b 2d 60 |..1.oQf3.m.f.+-`|
+| 1e 1d 21 08 e1 71 09 09 09 09 09 09 09 09 09 09 |..!..q..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 fb 6f 51 66 33 c0 6d f0 66 0b 2b 2d 60 1e 1d |1.oQf3.m.f.+-`..|
+| 21 08 e1 71 |!..q |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #184 (first time)
+ssl_session_init: initializing ptr 0x7fca45be2960 size 688
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46076 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4451
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #186 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| db bb bf 65 08 47 e1 5a f8 07 fb 9d 25 e6 45 89 |...e.G.Z....%.E.|
+| 85 1a 41 ad 12 ac b5 f6 75 e1 db aa 92 5c 56 ed |..A.....u....\V.|
+| 2b 8a e8 0d cc 52 e5 ef d9 44 d0 64 78 8b 8d 87 |+....R...D.dx...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 cf 09 17 1a 90 bd 15 7c 66 3c 3e f3 d0 26 92 |........|f<>..&.|
+| 7e 96 74 e0 ad c2 07 d0 ac 8c 6f 9e 66 52 34 c2 |~.t.......o.fR4.|
+| f0 8d ec 81 a8 99 83 2a 03 c5 b0 97 33 82 53 f7 |.......*....3.S.|
+| d9 01 56 6c 70 be cc 8a 24 31 71 72 73 |..Vlp...$1qrs |
+hash out[136]:
+| db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......|
+| 0a 1b 71 69 b3 06 79 e5 df de 9f ab d7 2d 71 90 |..qi..y......-q.|
+| 98 5e 7a 3e dc f0 fd 7c b9 f5 19 14 10 95 69 10 |.^z>...|......i.|
+| 6a dc 4c aa d1 f8 4a 69 81 98 98 df bb 6b df 0a |j.L...Ji.....k..|
+| a6 5d 9c 63 b5 a3 03 99 45 55 24 98 3d 40 1a 94 |.].c....EU$.=@..|
+| 93 99 85 66 ae 49 13 9b f0 b4 78 ab b2 95 7e c0 |...f.I....x...~.|
+| d6 f1 9e ff a7 76 d7 cf 97 f1 ca 2d 26 59 10 fc |.....v.....-&Y..|
+| 31 73 d5 9e 92 32 70 82 a6 f8 fd d2 84 3b 8e 9f |1s...2p......;..|
+| b5 1a 54 1d 71 76 9e cb |..T.qv.. |
+PRF out[136]:
+| db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......|
+| 0a 1b 71 69 b3 06 79 e5 df de 9f ab d7 2d 71 90 |..qi..y......-q.|
+| 98 5e 7a 3e dc f0 fd 7c b9 f5 19 14 10 95 69 10 |.^z>...|......i.|
+| 6a dc 4c aa d1 f8 4a 69 81 98 98 df bb 6b df 0a |j.L...Ji.....k..|
+| a6 5d 9c 63 b5 a3 03 99 45 55 24 98 3d 40 1a 94 |.].c....EU$.=@..|
+| 93 99 85 66 ae 49 13 9b f0 b4 78 ab b2 95 7e c0 |...f.I....x...~.|
+| d6 f1 9e ff a7 76 d7 cf 97 f1 ca 2d 26 59 10 fc |.....v.....-&Y..|
+| 31 73 d5 9e 92 32 70 82 a6 f8 fd d2 84 3b 8e 9f |1s...2p......;..|
+| b5 1a 54 1d 71 76 9e cb |..T.qv.. |
+key expansion[136]:
+| db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......|
+| 0a 1b 71 69 b3 06 79 e5 df de 9f ab d7 2d 71 90 |..qi..y......-q.|
+| 98 5e 7a 3e dc f0 fd 7c b9 f5 19 14 10 95 69 10 |.^z>...|......i.|
+| 6a dc 4c aa d1 f8 4a 69 81 98 98 df bb 6b df 0a |j.L...Ji.....k..|
+| a6 5d 9c 63 b5 a3 03 99 45 55 24 98 3d 40 1a 94 |.].c....EU$.=@..|
+| 93 99 85 66 ae 49 13 9b f0 b4 78 ab b2 95 7e c0 |...f.I....x...~.|
+| d6 f1 9e ff a7 76 d7 cf 97 f1 ca 2d 26 59 10 fc |.....v.....-&Y..|
+| 31 73 d5 9e 92 32 70 82 a6 f8 fd d2 84 3b 8e 9f |1s...2p......;..|
+| b5 1a 54 1d 71 76 9e cb |..T.qv.. |
+Client MAC key[20]:
+| db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......|
+| 0a 1b 71 69 |..qi |
+Server MAC key[20]:
+| b3 06 79 e5 df de 9f ab d7 2d 71 90 98 5e 7a 3e |..y......-q..^z>|
+| dc f0 fd 7c |...| |
+Client Write key[32]:
+| b9 f5 19 14 10 95 69 10 6a dc 4c aa d1 f8 4a 69 |......i.j.L...Ji|
+| 81 98 98 df bb 6b df 0a a6 5d 9c 63 b5 a3 03 99 |.....k...].c....|
+Server Write key[32]:
+| 45 55 24 98 3d 40 1a 94 93 99 85 66 ae 49 13 9b |EU$.=@.....f.I..|
+| f0 b4 78 ab b2 95 7e c0 d6 f1 9e ff a7 76 d7 cf |..x...~......v..|
+Client Write IV[16]:
+| 97 f1 ca 2d 26 59 10 fc 31 73 d5 9e 92 32 70 82 |...-&Y..1s...2p.|
+Server Write IV[16]:
+| a6 f8 fd d2 84 3b 8e 9f b5 1a 54 1d 71 76 9e cb |.....;....T.qv..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #188 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70...
+looking for RSA pre-mastera3909729d90d64d1a54d9ea0d4a24023a60c44da755d2899...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 14 bb dd 69 e9 d2 df ca ae 2c 79 78 36 1c 62 43 |...i.....,yx6.bC|
+| f2 63 cd 89 31 55 7f ec 4a e6 fd 36 58 d4 0c c0 |.c..1U..J..6X...|
+| 58 0a 09 15 ce 27 8d f4 ff 0e 72 96 d0 56 a4 b5 |X....'....r..V..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 cf 09 17 1a 90 bd 15 7c 66 3c 3e f3 d0 26 92 |........|f<>..&.|
+| 7e 96 74 e0 ad c2 07 d0 ac 8c 6f 9e 66 52 34 c2 |~.t.......o.fR4.|
+| f0 8d ec 81 a8 99 83 2a 03 c5 b0 97 33 82 53 f7 |.......*....3.S.|
+| d9 01 56 6c 70 be cc 8a 24 31 71 72 73 |..Vlp...$1qrs |
+hash out[136]:
+| 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6|
+| d2 db 85 17 e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 |.....j......'...|
+| 9e 7c ce 67 f9 cb b2 9c 37 a3 cf 03 33 e4 0c 82 |.|.g....7...3...|
+| 7c d2 0c 86 fc 35 62 3d 9c b7 28 e9 ea a4 72 68 ||....5b=..(...rh|
+| 74 e8 04 da 70 59 d9 a1 e9 b8 08 7b eb 81 53 6b |t...pY.....{..Sk|
+| 5d 50 f0 eb be 00 1d c5 e3 60 a1 36 f9 fd 5f c6 |]P.......`.6.._.|
+| 7d 5a b7 52 4d b1 d8 fe 42 27 e3 cf a6 74 71 a4 |}Z.RM...B'...tq.|
+| 32 45 b6 4a 50 09 2b 01 26 45 79 46 07 cb 3e 85 |2E.JP.+.&EyF..>.|
+| 73 5f cf d5 df e8 54 16 |s_....T. |
+PRF out[136]:
+| 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6|
+| d2 db 85 17 e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 |.....j......'...|
+| 9e 7c ce 67 f9 cb b2 9c 37 a3 cf 03 33 e4 0c 82 |.|.g....7...3...|
+| 7c d2 0c 86 fc 35 62 3d 9c b7 28 e9 ea a4 72 68 ||....5b=..(...rh|
+| 74 e8 04 da 70 59 d9 a1 e9 b8 08 7b eb 81 53 6b |t...pY.....{..Sk|
+| 5d 50 f0 eb be 00 1d c5 e3 60 a1 36 f9 fd 5f c6 |]P.......`.6.._.|
+| 7d 5a b7 52 4d b1 d8 fe 42 27 e3 cf a6 74 71 a4 |}Z.RM...B'...tq.|
+| 32 45 b6 4a 50 09 2b 01 26 45 79 46 07 cb 3e 85 |2E.JP.+.&EyF..>.|
+| 73 5f cf d5 df e8 54 16 |s_....T. |
+key expansion[136]:
+| 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6|
+| d2 db 85 17 e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 |.....j......'...|
+| 9e 7c ce 67 f9 cb b2 9c 37 a3 cf 03 33 e4 0c 82 |.|.g....7...3...|
+| 7c d2 0c 86 fc 35 62 3d 9c b7 28 e9 ea a4 72 68 ||....5b=..(...rh|
+| 74 e8 04 da 70 59 d9 a1 e9 b8 08 7b eb 81 53 6b |t...pY.....{..Sk|
+| 5d 50 f0 eb be 00 1d c5 e3 60 a1 36 f9 fd 5f c6 |]P.......`.6.._.|
+| 7d 5a b7 52 4d b1 d8 fe 42 27 e3 cf a6 74 71 a4 |}Z.RM...B'...tq.|
+| 32 45 b6 4a 50 09 2b 01 26 45 79 46 07 cb 3e 85 |2E.JP.+.&EyF..>.|
+| 73 5f cf d5 df e8 54 16 |s_....T. |
+Client MAC key[20]:
+| 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6|
+| d2 db 85 17 |.... |
+Server MAC key[20]:
+| e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 9e 7c ce 67 |.j......'....|.g|
+| f9 cb b2 9c |.... |
+Client Write key[32]:
+| 37 a3 cf 03 33 e4 0c 82 7c d2 0c 86 fc 35 62 3d |7...3...|....5b=|
+| 9c b7 28 e9 ea a4 72 68 74 e8 04 da 70 59 d9 a1 |..(...rht...pY..|
+Server Write key[32]:
+| e9 b8 08 7b eb 81 53 6b 5d 50 f0 eb be 00 1d c5 |...{..Sk]P......|
+| e3 60 a1 36 f9 fd 5f c6 7d 5a b7 52 4d b1 d8 fe |.`.6.._.}Z.RM...|
+Client Write IV[16]:
+| 42 27 e3 cf a6 74 71 a4 32 45 b6 4a 50 09 2b 01 |B'...tq.2E.JP.+.|
+Server Write IV[16]:
+| 26 45 79 46 07 cb 3e 85 73 5f cf d5 df e8 54 16 |&EyF..>.s_....T.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 14 bb dd 69 e9 d2 df ca ae 2c 79 78 36 1c 62 43 |...i.....,yx6.bC|
+| f2 63 cd 89 31 55 7f ec 4a e6 fd 36 58 d4 0c c0 |.c..1U..J..6X...|
+| 58 0a 09 15 ce 27 8d f4 ff 0e 72 96 d0 56 a4 b5 |X....'....r..V..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 67 a0 a9 5d 58 5e e0 b3 98 cd 72 bd c0 6f 5a 15 |g..]X^....r..oZ.|
+| 7d 1a 94 72 ea 3a 28 5c 5d ad 94 de e7 28 87 ec |}..r.:(\]....(..|
+| 74 56 19 80 ac c1 cc 76 83 35 41 66 ea fc 5f 5d |tV.....v.5Af.._]|
+| a2 f6 dd e2 41 b2 22 a9 8e 10 78 30 5b 74 78 c8 |....A."...x0[tx.|
+Plaintext[64]:
+| e7 da 72 44 36 11 fb 0c b1 fd d5 5f 9c e2 67 5c |..rD6......_..g\|
+| 14 00 00 0c 6e b2 03 07 8d 9a 6a 6a b1 91 1f 51 |....n.....jj...Q|
+| ee 15 cb b7 a9 78 e6 85 0e 37 47 03 cc 5b a1 4f |.....x...7G..[.O|
+| 66 c7 71 e0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |f.q.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 15 cb b7 a9 78 e6 85 0e 37 47 03 cc 5b a1 4f |.....x...7G..[.O|
+| 66 c7 71 e0 |f.q. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #189 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 85 2e 72 52 ff fa 92 2d c3 df 38 8b e0 38 61 4b |..rR...-..8..8aK|
+| a7 e4 fb ad 13 b1 33 d2 a0 2e 6f f0 f1 30 4f b1 |......3...o..0O.|
+| 18 79 d9 5a a4 48 be c7 cb b2 22 96 5a 6c 52 e5 |.y.Z.H....".ZlR.|
+| fd 37 37 1a b3 60 12 f3 1f 3a a2 b9 a2 13 b0 32 |.77..`...:.....2|
+Plaintext[64]:
+| 80 a6 2b 8c 9a 2c 85 25 53 69 d2 57 82 e7 a3 a2 |..+..,.%Si.W....|
+| 14 00 00 0c f5 0e 11 58 99 e8 af b6 8a 05 d5 03 |.......X........|
+| 02 31 9e 7d 02 07 1b c4 08 29 05 cd 5c 3e cc 07 |.1.}.....)..\>..|
+| 7b e3 4d 64 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |{.Md............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 02 31 9e 7d 02 07 1b c4 08 29 05 cd 5c 3e cc 07 |.1.}.....)..\>..|
+| 7b e3 4d 64 |{.Md |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #190 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 98 8e 76 0a 94 5f 9d 7d fe 73 dd 80 e0 eb 64 63 |..v.._.}.s....dc|
+| 31 b4 dd af 03 b9 20 e4 a2 dc 04 d9 94 9f 99 eb |1..... .........|
+| 66 4e a5 2b c6 10 01 e2 df fd 65 ff 2e 44 0a 40 |fN.+......e..D.@|
+| 86 d6 b8 b8 b9 71 b3 43 bf 5b fb 3e d8 37 89 69 |.....q.C.[.>.7.i|
+| 33 9f 02 32 e2 bb 25 a1 2a 0d 29 56 db d2 e6 e1 |3..2..%.*.)V....|
+| ac a5 6d 1d 2b 72 b2 f2 21 a5 d1 4d 6c 3f 95 4f |..m.+r..!..Ml?.O|
+| b7 83 ce f4 76 99 9a 1d 0d 79 60 4f 6b fb 0e 2c |....v....y`Ok..,|
+Plaintext[112]:
+| 6a 13 3c 6d 03 49 af 0b 4f 6d ab 94 ac b3 3e 7c |j.<m.I..Om....>||
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....|
+| 96 22 6c cb f9 cf 36 1f 8e ee d4 34 9f 89 42 ff |."l...6....4..B.|
+| e9 cd 4a 31 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..J1............|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 38 1f 37 54 51 ba b6 e0 17 94 d2 f9 24 c3 da af |8.7TQ.......$...|
+| b0 89 84 cf |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 46076 found (nil)
+association_find: TCP port 4451 found 0x372ca60
+
+dissect_ssl enter frame #191 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 35 04 8a 13 44 cc 63 86 8b 6b 2f f1 1d ee 6f 5e |5...D.c..k/...o^|
+| 51 84 57 93 df 68 8a 3b b1 9a 1d 8b 3a 26 2d 27 |Q.W..h.;....:&-'|
+| 36 7d b0 a3 e2 fc 1d 95 70 a6 e4 d9 1a 4d 0f 8c |6}......p....M..|
+| 54 36 ac 9f 66 4b 1a bc cb 5b 3e 93 3d 74 e3 1b |T6..fK...[>.=t..|
+| 70 ea 48 6d 88 73 39 38 a1 35 f4 5e f4 db fb 05 |p.Hm.s98.5.^....|
+| a4 f4 77 d6 9e 76 e9 72 9f 13 c2 5f 64 48 ff 01 |..w..v.r..._dH..|
+| 34 fa 7d 88 50 be a5 0b 5d 22 d6 ca f7 ba 01 54 |4.}.P...]".....T|
+| 86 d1 3c 9f 50 91 77 27 47 a8 a1 41 13 cd 24 ef |..<.P.w'G..A..$.|
+| da d1 1f 2e 2f 9c 0c f1 4c f3 3b 52 df cf 86 93 |..../...L.;R....|
+| 99 9b da 67 c1 30 9d ac 57 58 72 11 74 20 1d fc |...g.0..WXr.t ..|
+| 73 a0 34 9d d9 b4 6e 94 69 20 48 77 fd a9 38 15 |s.4...n.i Hw..8.|
+| 58 94 f8 02 17 72 c6 d5 df d9 61 d6 84 9e d4 9f |X....r....a.....|
+| b7 b1 78 1d 51 8a 7c 1e 0f 90 2b 98 f6 5f e8 ef |..x.Q.|...+.._..|
+| 38 27 9e bd 1b 56 7f 6e a6 44 10 bf ad 82 65 58 |8'...V.n.D....eX|
+| 48 fa 18 b9 a0 7d 2d a9 0e 63 06 c8 33 f8 b4 68 |H....}-..c..3..h|
+| 9d 8f a8 16 52 e8 1b 20 5b f3 78 8e 6a 96 3e 5e |....R.. [.x.j.>^|
+| 3c f6 2b 57 b8 ac 31 1d 9c 52 38 0a 6e 1a a9 7c |<.+W..1..R8.n..||
+| e9 a6 96 34 d7 39 6a dd 7a 37 35 5e a3 e5 7d 3a |...4.9j.z75^..}:|
+| 5b 81 d6 79 e7 50 ed 84 5b 0a 0c 39 a8 dd fb 78 |[..y.P..[..9...x|
+| f8 cd 8d 6c 19 28 18 e0 f3 bf 10 38 2f ce ee bb |...l.(.....8/...|
+| 88 a9 d1 29 25 59 e2 36 ae 44 5b d9 c6 ea e0 e7 |...)%Y.6.D[.....|
+| c1 a3 8b a3 48 21 4d f7 52 dc bb cc 4a ca 99 b5 |....H!M.R...J...|
+| 76 a4 48 a2 6b c1 31 31 7a e9 e9 0b 58 b6 7c 46 |v.H.k.11z...X.|F|
+| a3 13 91 c8 56 28 29 c6 a1 4f 1a ec 14 54 0d e2 |....V()..O...T..|
+| d8 28 ed 14 b0 2b 1b 5f 63 47 f6 1c a9 f8 2c 42 |.(...+._cG....,B|
+Plaintext[400]:
+| 75 e8 77 a0 b0 85 88 04 73 cf 32 da 8a 45 59 6e |u.w.....s.2..EYn|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25|
+| 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e f5 84 bd 64 |nl'</script>...d|
+| 89 98 cb 2b ed a1 9f b7 83 d7 f9 7d b2 1a b4 c0 |...+.......}....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bb 30 c9 62 0b 3b 25 5e 7f c0 51 26 d9 35 b7 e8 |.0.b.;%^..Q&.5..|
+| b7 b6 83 04 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4451 found 0x372ca60
+
+dissect_ssl enter frame #192 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 28 9a 27 19 27 cb 98 39 7a 52 2d bd 35 18 23 c1 |(.'.'..9zR-.5.#.|
+| 6a 8c 86 d5 c7 16 80 f1 bc b1 f9 0a d8 f3 96 1f |j...............|
+| a2 b5 62 9f 5d 7d a6 84 68 c1 7e a2 b3 2a 51 95 |..b.]}..h.~..*Q.|
+Plaintext[48]:
+| cd 96 95 ec ae 66 1a f2 5a 3c d2 59 c3 0a 2d 7b |.....f..Z<.Y..-{|
+| 01 00 5d 32 31 1f 3b 54 52 0f a1 77 67 12 ea e3 |..]21.;TR..wg...|
+| 90 31 45 27 61 3b 09 09 09 09 09 09 09 09 09 09 |.1E'a;..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 32 31 1f 3b 54 52 0f a1 77 67 12 ea e3 90 31 |]21.;TR..wg....1|
+| 45 27 61 3b |E'a; |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #194 (first time)
+ conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 5e 12 3b 07 56 32 7c 9f 81 18 67 23 d6 71 59 92 |^.;.V2|...g#.qY.|
+| a1 8e 3c 84 ed 1f 95 0e 30 f5 a1 2c ca c9 41 8e |..<.....0..,..A.|
+| 54 e1 a8 97 91 28 64 72 c7 3d ee 4f 8a 87 ca 7e |T....(dr.=.O...~|
+Plaintext[48]:
+| e9 e3 84 94 b9 e3 1c fc 46 c0 0b 06 9d 4a 74 ef |........F....Jt.|
+| 01 00 ec b0 ce 0e 32 25 97 8f 23 13 7e a3 20 85 |......2%..#.~. .|
+| 07 3c 8f 86 b7 36 09 09 09 09 09 09 09 09 09 09 |.<...6..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ec b0 ce 0e 32 25 97 8f 23 13 7e a3 20 85 07 3c |....2%..#.~. ..<|
+| 8f 86 b7 36 |...6 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #199 (first time)
+ssl_session_init: initializing ptr 0x7fca45be4f20 size 688
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45020 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4452
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #201 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 14 bb dd 69 e9 d2 df ca ae 2c 79 78 36 1c 62 43 |...i.....,yx6.bC|
+| f2 63 cd 89 31 55 7f ec 4a e6 fd 36 58 d4 0c c0 |.c..1U..J..6X...|
+| 58 0a 09 15 ce 27 8d f4 ff 0e 72 96 d0 56 a4 b5 |X....'....r..V..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 48 ff 58 ca 7c 79 fe 2c 01 92 0a c6 9b b1 26 |.H.X.|y.,......&|
+| b9 51 58 90 1d 16 7d 7f ef 06 a5 28 da 52 34 c2 |.QX...}....(.R4.|
+| f0 d8 87 58 c9 e9 b8 c6 07 25 ce ea b9 15 98 71 |...X.....%.....q|
+| 5e 86 a9 fc 5b 2e a5 65 da 3b 56 12 6f |^...[..e.;V.o |
+hash out[136]:
+| 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.|
+| 4e dd 19 36 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 |N..6|>...m....0w|
+| 44 a5 6f 2b 7b 61 15 a3 d6 c8 a4 ed 38 3f 2c 36 |D.o+{a......8?,6|
+| 46 6a 89 0f 88 a1 65 e4 7f 21 8e cc 3e 33 5e 24 |Fj....e..!..>3^$|
+| 6f 97 f7 6d dc 08 0e 72 ae e8 58 2a b7 4e 7b 74 |o..m...r..X*.N{t|
+| 2e 26 b4 ae 56 72 0b e0 c7 6c 5d 3c a1 1b e9 d7 |.&..Vr...l]<....|
+| 1a 8d f8 d6 81 5a ab 56 92 57 c2 56 2e d6 72 13 |.....Z.V.W.V..r.|
+| 47 fe 5a 5d 4c 36 28 2a 45 70 60 56 93 b7 08 86 |G.Z]L6(*Ep`V....|
+| d3 42 64 8c d2 2b ad aa |.Bd..+.. |
+PRF out[136]:
+| 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.|
+| 4e dd 19 36 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 |N..6|>...m....0w|
+| 44 a5 6f 2b 7b 61 15 a3 d6 c8 a4 ed 38 3f 2c 36 |D.o+{a......8?,6|
+| 46 6a 89 0f 88 a1 65 e4 7f 21 8e cc 3e 33 5e 24 |Fj....e..!..>3^$|
+| 6f 97 f7 6d dc 08 0e 72 ae e8 58 2a b7 4e 7b 74 |o..m...r..X*.N{t|
+| 2e 26 b4 ae 56 72 0b e0 c7 6c 5d 3c a1 1b e9 d7 |.&..Vr...l]<....|
+| 1a 8d f8 d6 81 5a ab 56 92 57 c2 56 2e d6 72 13 |.....Z.V.W.V..r.|
+| 47 fe 5a 5d 4c 36 28 2a 45 70 60 56 93 b7 08 86 |G.Z]L6(*Ep`V....|
+| d3 42 64 8c d2 2b ad aa |.Bd..+.. |
+key expansion[136]:
+| 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.|
+| 4e dd 19 36 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 |N..6|>...m....0w|
+| 44 a5 6f 2b 7b 61 15 a3 d6 c8 a4 ed 38 3f 2c 36 |D.o+{a......8?,6|
+| 46 6a 89 0f 88 a1 65 e4 7f 21 8e cc 3e 33 5e 24 |Fj....e..!..>3^$|
+| 6f 97 f7 6d dc 08 0e 72 ae e8 58 2a b7 4e 7b 74 |o..m...r..X*.N{t|
+| 2e 26 b4 ae 56 72 0b e0 c7 6c 5d 3c a1 1b e9 d7 |.&..Vr...l]<....|
+| 1a 8d f8 d6 81 5a ab 56 92 57 c2 56 2e d6 72 13 |.....Z.V.W.V..r.|
+| 47 fe 5a 5d 4c 36 28 2a 45 70 60 56 93 b7 08 86 |G.Z]L6(*Ep`V....|
+| d3 42 64 8c d2 2b ad aa |.Bd..+.. |
+Client MAC key[20]:
+| 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.|
+| 4e dd 19 36 |N..6 |
+Server MAC key[20]:
+| 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 44 a5 6f 2b ||>...m....0wD.o+|
+| 7b 61 15 a3 |{a.. |
+Client Write key[32]:
+| d6 c8 a4 ed 38 3f 2c 36 46 6a 89 0f 88 a1 65 e4 |....8?,6Fj....e.|
+| 7f 21 8e cc 3e 33 5e 24 6f 97 f7 6d dc 08 0e 72 |.!..>3^$o..m...r|
+Server Write key[32]:
+| ae e8 58 2a b7 4e 7b 74 2e 26 b4 ae 56 72 0b e0 |..X*.N{t.&..Vr..|
+| c7 6c 5d 3c a1 1b e9 d7 1a 8d f8 d6 81 5a ab 56 |.l]<.........Z.V|
+Client Write IV[16]:
+| 92 57 c2 56 2e d6 72 13 47 fe 5a 5d 4c 36 28 2a |.W.V..r.G.Z]L6(*|
+Server Write IV[16]:
+| 45 70 60 56 93 b7 08 86 d3 42 64 8c d2 2b ad aa |Ep`V.....Bd..+..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #203 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b...
+looking for RSA pre-master00809642d847c3b2d14fd5633cd5e3781e6875fd448033a8...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| af f5 8f 23 60 51 73 d7 b9 31 24 69 2a 27 9d ee |...#`Qs..1$i*'..|
+| b0 ad 9e 41 a7 97 c3 f4 a1 04 64 70 e1 37 99 e8 |...A......dp.7..|
+| ef 5c e6 b2 03 be 70 66 05 36 4f 23 4b cd 23 c0 |.\....pf.6O#K.#.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f0 48 ff 58 ca 7c 79 fe 2c 01 92 0a c6 9b b1 26 |.H.X.|y.,......&|
+| b9 51 58 90 1d 16 7d 7f ef 06 a5 28 da 52 34 c2 |.QX...}....(.R4.|
+| f0 d8 87 58 c9 e9 b8 c6 07 25 ce ea b9 15 98 71 |...X.....%.....q|
+| 5e 86 a9 fc 5b 2e a5 65 da 3b 56 12 6f |^...[..e.;V.o |
+hash out[136]:
+| 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U|
+| b3 a3 45 25 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 |..E%;.........p.|
+| dc a7 f5 e8 d6 18 55 ba a2 bb c0 63 8a 08 7b fe |......U....c..{.|
+| a0 1c 8a 49 69 ea af 84 3e dd 20 c8 f5 78 fa a3 |...Ii...>. ..x..|
+| 08 1d 9f 63 5e 50 d0 7f 00 79 52 f7 16 93 92 cd |...c^P...yR.....|
+| 7e 6c bf ba 6c 21 a8 7b b2 11 1f 28 b2 f3 27 5d |~l..l!.{...(..']|
+| a8 1f 51 82 01 2e 61 1d 13 af 32 2a 55 68 64 02 |..Q...a...2*Uhd.|
+| 19 74 53 ad cd e5 09 58 10 1e a6 5b 13 5c 68 f1 |.tS....X...[.\h.|
+| 24 ce 48 cc df a7 da 62 |$.H....b |
+PRF out[136]:
+| 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U|
+| b3 a3 45 25 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 |..E%;.........p.|
+| dc a7 f5 e8 d6 18 55 ba a2 bb c0 63 8a 08 7b fe |......U....c..{.|
+| a0 1c 8a 49 69 ea af 84 3e dd 20 c8 f5 78 fa a3 |...Ii...>. ..x..|
+| 08 1d 9f 63 5e 50 d0 7f 00 79 52 f7 16 93 92 cd |...c^P...yR.....|
+| 7e 6c bf ba 6c 21 a8 7b b2 11 1f 28 b2 f3 27 5d |~l..l!.{...(..']|
+| a8 1f 51 82 01 2e 61 1d 13 af 32 2a 55 68 64 02 |..Q...a...2*Uhd.|
+| 19 74 53 ad cd e5 09 58 10 1e a6 5b 13 5c 68 f1 |.tS....X...[.\h.|
+| 24 ce 48 cc df a7 da 62 |$.H....b |
+key expansion[136]:
+| 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U|
+| b3 a3 45 25 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 |..E%;.........p.|
+| dc a7 f5 e8 d6 18 55 ba a2 bb c0 63 8a 08 7b fe |......U....c..{.|
+| a0 1c 8a 49 69 ea af 84 3e dd 20 c8 f5 78 fa a3 |...Ii...>. ..x..|
+| 08 1d 9f 63 5e 50 d0 7f 00 79 52 f7 16 93 92 cd |...c^P...yR.....|
+| 7e 6c bf ba 6c 21 a8 7b b2 11 1f 28 b2 f3 27 5d |~l..l!.{...(..']|
+| a8 1f 51 82 01 2e 61 1d 13 af 32 2a 55 68 64 02 |..Q...a...2*Uhd.|
+| 19 74 53 ad cd e5 09 58 10 1e a6 5b 13 5c 68 f1 |.tS....X...[.\h.|
+| 24 ce 48 cc df a7 da 62 |$.H....b |
+Client MAC key[20]:
+| 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U|
+| b3 a3 45 25 |..E% |
+Server MAC key[20]:
+| 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 dc a7 f5 e8 |;.........p.....|
+| d6 18 55 ba |..U. |
+Client Write key[32]:
+| a2 bb c0 63 8a 08 7b fe a0 1c 8a 49 69 ea af 84 |...c..{....Ii...|
+| 3e dd 20 c8 f5 78 fa a3 08 1d 9f 63 5e 50 d0 7f |>. ..x.....c^P..|
+Server Write key[32]:
+| 00 79 52 f7 16 93 92 cd 7e 6c bf ba 6c 21 a8 7b |.yR.....~l..l!.{|
+| b2 11 1f 28 b2 f3 27 5d a8 1f 51 82 01 2e 61 1d |...(..']..Q...a.|
+Client Write IV[16]:
+| 13 af 32 2a 55 68 64 02 19 74 53 ad cd e5 09 58 |..2*Uhd..tS....X|
+Server Write IV[16]:
+| 10 1e a6 5b 13 5c 68 f1 24 ce 48 cc df a7 da 62 |...[.\h.$.H....b|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| af f5 8f 23 60 51 73 d7 b9 31 24 69 2a 27 9d ee |...#`Qs..1$i*'..|
+| b0 ad 9e 41 a7 97 c3 f4 a1 04 64 70 e1 37 99 e8 |...A......dp.7..|
+| ef 5c e6 b2 03 be 70 66 05 36 4f 23 4b cd 23 c0 |.\....pf.6O#K.#.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fb 86 82 ea df 4f 26 3a e6 70 78 5a 78 03 8f 7e |.....O&:.pxZx..~|
+| bf e3 b8 33 ad c8 71 2b aa bd 07 4e 0a b1 98 3f |...3..q+...N...?|
+| 62 fc d8 05 2b c7 2e d4 27 e3 49 e5 8b 91 9e 3c |b...+...'.I....<|
+| 3c 57 a6 38 d4 e1 7a 65 90 c0 8b 70 05 75 f7 98 |<W.8..ze...p.u..|
+Plaintext[64]:
+| d1 6d 51 53 dc 93 c5 50 a5 df 93 4d 13 62 bb 6b |.mQS...P...M.b.k|
+| 14 00 00 0c 12 12 88 f4 ae 49 8c 5c 45 33 8c db |.........I.\E3..|
+| b5 81 a7 00 d2 ae 13 ce d8 8e 1d f8 24 8e 73 b8 |............$.s.|
+| 4f 7b f5 fa 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |O{..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b5 81 a7 00 d2 ae 13 ce d8 8e 1d f8 24 8e 73 b8 |............$.s.|
+| 4f 7b f5 fa |O{.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #204 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 2d 48 94 ce 06 1e bc 9e 05 8d 42 fb 22 b1 4b 8e |-H........B.".K.|
+| b1 db d0 bd 20 ff c2 49 5a f3 6f b1 84 ba 0f 0a |.... ..IZ.o.....|
+| 98 3b 49 53 f4 ee fa b0 dd c2 dd d2 67 43 e7 06 |.;IS........gC..|
+| 31 58 42 fe 71 aa 56 62 a3 24 10 e8 e6 77 27 0a |1XB.q.Vb.$...w'.|
+Plaintext[64]:
+| bd 2a bd ca eb 3f dd ac eb 41 94 19 8c 24 3d 20 |.*...?...A...$= |
+| 14 00 00 0c e0 cc d2 15 ff 82 32 28 9b 4c df 25 |..........2(.L.%|
+| 4c 8b d2 5a e2 88 95 63 0c 07 42 ca 71 c8 e2 e1 |L..Z...c..B.q...|
+| 26 be 27 4f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |&.'O............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4c 8b d2 5a e2 88 95 63 0c 07 42 ca 71 c8 e2 e1 |L..Z...c..B.q...|
+| 26 be 27 4f |&.'O |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #205 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 2f 10 4e fe 24 96 4b 1d 7a 4b 9b c4 56 5c ac 9b |/.N.$.K.zK..V\..|
+| 12 2a 92 a1 2c 30 2a 89 8e 80 3c 95 12 86 c2 95 |.*..,0*...<.....|
+| 85 a5 f1 b7 03 b4 fe 68 0a 07 7b 2a ad 22 df 7c |.......h..{*.".||
+| d3 e3 3b 75 68 4a 31 6f fa ed 2f f4 7f cc ae 8b |..;uhJ1o../.....|
+| 1c dc 66 3b 7e 80 2e 71 8b c2 24 9f 70 0f a4 7d |..f;~..q..$.p..}|
+| 33 b7 d4 4d 36 82 75 39 5e 66 f6 86 9d 28 b1 cb |3..M6.u9^f...(..|
+| 78 48 20 e0 05 ba 0d 67 98 1f 14 cb 53 b6 98 a2 |xH ....g....S...|
+Plaintext[112]:
+| e9 56 e3 eb ad d1 4d 10 bc 58 09 c5 88 fa f9 69 |.V....M..X.....i|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 32 0d 0a 0d 0a 53 58 bb 3a 78 88 c7 b8 |4452....SX.:x...|
+| 2e a3 a4 9d 99 ac 5f 80 c8 dd 6c b9 03 03 03 03 |......_...l.....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 75 04 52 ee 4c 1e 3d ff c6 de 5b 2c c5 5e 38 7b |u.R.L.=...[,.^8{|
+| 93 47 fb a6 |.G.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45020 found (nil)
+association_find: TCP port 4452 found 0x37006d0
+
+dissect_ssl enter frame #206 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 9a a6 68 c5 53 72 94 7c 4b e3 a4 1b 4e e2 72 02 |..h.Sr.|K...N.r.|
+| 73 e3 2f 3b b8 39 a6 23 5f 33 90 59 74 e3 aa c0 |s./;.9.#_3.Yt...|
+| 40 96 23 91 34 52 bf b1 b8 f3 bc 1c 37 30 bf 47 |@.#.4R......70.G|
+| 24 7d 07 e8 f4 06 d5 0f dd 7a 9d 31 ce d2 bf af |$}.......z.1....|
+| c1 0e 64 a4 c7 70 58 0b 5a de 44 64 6d 42 b4 ed |..d..pX.Z.DdmB..|
+| d2 c1 ba ec ca 7c 1d eb 5e 9d ba 31 73 3f 60 bd |.....|..^..1s?`.|
+| ea b4 da da ac 12 a6 e1 02 65 78 b5 ab 21 14 5b |.........ex..!.[|
+| 33 79 4b 41 d6 6e 16 9d 54 de 89 b9 9f 67 f4 59 |3yKA.n..T....g.Y|
+| df 49 14 96 f9 ec 1b 24 f0 9f 40 53 28 08 49 b7 |.I.....$..@S(.I.|
+| 64 d9 09 76 ac 2d 46 33 9d d2 7d 46 b1 ad 36 63 |d..v.-F3..}F..6c|
+| 57 94 bc 72 a5 c2 04 98 6f 71 e7 dd e2 29 74 c7 |W..r....oq...)t.|
+| dc 68 70 6e 82 ce c6 1d 62 ca 07 ef c9 46 c5 25 |.hpn....b....F.%|
+| 69 bd 88 c6 d5 42 f3 17 21 61 e3 6d 73 59 e8 ff |i....B..!a.msY..|
+| 2c e6 33 04 72 b1 be 88 ec 86 2e 6b b6 50 69 af |,.3.r......k.Pi.|
+| 0a 10 ad f4 4a fb 95 db fa b7 26 24 43 7e 9c 08 |....J.....&$C~..|
+| 9a c7 d4 6c 24 48 b5 31 31 b1 7a 06 0f 43 38 86 |...l$H.11.z..C8.|
+| 0c d9 88 49 a4 66 85 47 0c 42 12 0c fe 4c 82 5d |...I.f.G.B...L.]|
+| 33 c5 7d 46 61 2b 7a 70 1a fc 97 04 0e 5b 97 3c |3.}Fa+zp.....[.<|
+| 3f 05 72 9a dc 05 81 c0 e4 62 2e 2d 78 87 ee 69 |?.r......b.-x..i|
+| ce 08 f9 58 f6 49 d6 00 91 3d 55 95 fc a4 7a 0f |...X.I...=U...z.|
+| 1e 9f a8 79 28 22 87 7c bc 32 f8 a7 e2 bf 0f 87 |...y(".|.2......|
+| 20 0b ec 96 bd db a5 f8 75 4a 63 96 64 e9 0e f6 | .......uJc.d...|
+| 5d cc de 1e e7 34 6f 72 8f 76 b1 77 bd b3 37 e8 |]....4or.v.w..7.|
+| 85 cf a7 6b 83 9c 06 64 14 08 48 dc 00 29 f9 45 |...k...d..H..).E|
+| fa 8a 40 72 ac 09 af 1f 4e c9 cf 34 e2 25 83 6d |..@r....N..4.%.m|
+Plaintext[400]:
+| 42 3c 17 b1 f0 d3 cf 75 e2 b2 f2 13 6b 54 23 19 |B<.....u....kT#.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D|
+| 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 25 75 3c ac |nl'</script>%u<.|
+| 33 0d 12 b8 c8 e5 d3 c3 ac 59 18 d2 e9 58 10 65 |3........Y...X.e|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 86 7a fa 50 78 0a df fb d3 e2 f3 83 f2 3b a0 1b |.z.Px........;..|
+| a6 60 6f fc |.`o. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4452 found 0x37006d0
+
+dissect_ssl enter frame #207 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 5c e2 4d 5f 85 eb 33 12 25 0e f5 83 f5 08 97 fc |\.M_..3.%.......|
+| 07 62 fa 28 a3 e2 b0 48 bc 5d 28 a5 9a 24 18 86 |.b.(...H.](..$..|
+| e3 e5 09 ea b8 06 53 35 18 a4 16 44 96 65 a5 e4 |......S5...D.e..|
+Plaintext[48]:
+| 04 d5 a9 5b 71 cb 91 da 72 d0 9e 8a 11 3b b2 9e |...[q...r....;..|
+| 01 00 72 ef cf a9 5f 5b c6 53 b8 9d 77 10 2d f9 |..r..._[.S..w.-.|
+| 24 53 89 41 3f 89 09 09 09 09 09 09 09 09 09 09 |$S.A?...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 72 ef cf a9 5f 5b c6 53 b8 9d 77 10 2d f9 24 53 |r..._[.S..w.-.$S|
+| 89 41 3f 89 |.A?. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #209 (first time)
+ conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 15 13 0a 7f 3d cd d8 6e 93 4a 4d bf b2 de b1 7a |....=..n.JM....z|
+| 53 85 97 97 5b 93 2f 5c 55 1d e5 5b d1 bd c8 64 |S...[./\U..[...d|
+| bb 6d 39 c4 6a 85 6c fe ca 3d 1d d1 c0 5d 56 3c |.m9.j.l..=...]V<|
+Plaintext[48]:
+| 6a 27 bc 4d 0b 53 4e 4f 1a f1 d0 01 e0 6d dc 63 |j'.M.SNO.....m.c|
+| 01 00 4e 5d 6e 8c 50 7a 5c d1 80 0e 42 89 60 62 |..N]n.Pz\...B.`b|
+| ae 74 70 a2 cc b7 09 09 09 09 09 09 09 09 09 09 |.tp.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 5d 6e 8c 50 7a 5c d1 80 0e 42 89 60 62 ae 74 |N]n.Pz\...B.`b.t|
+| 70 a2 cc b7 |p... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #214 (first time)
+ssl_session_init: initializing ptr 0x7fca45be7420 size 688
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52902 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4453
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #216 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| af f5 8f 23 60 51 73 d7 b9 31 24 69 2a 27 9d ee |...#`Qs..1$i*'..|
+| b0 ad 9e 41 a7 97 c3 f4 a1 04 64 70 e1 37 99 e8 |...A......dp.7..|
+| ef 5c e6 b2 03 be 70 66 05 36 4f 23 4b cd 23 c0 |.\....pf.6O#K.#.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 ab 05 91 79 95 d3 36 41 09 de 0e 9c 4f ba a5 |....y..6A....O..|
+| 7b a3 13 99 9b cb fd 62 30 b4 30 da da 52 34 c2 |{......b0.0..R4.|
+| f1 89 1a d7 f3 82 ca b1 4a 6f e1 b6 9e ff 5f 43 |........Jo...._C|
+| b8 61 23 bd 29 6b 35 35 33 01 b5 fe 0e |.a#.)k553.... |
+hash out[136]:
+| 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C|
+| 5e ba 4f 9f 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 |^.O........L.M4.|
+| fd 73 d0 45 56 d2 63 b3 92 92 9e fb d1 fb e9 80 |.s.EV.c.........|
+| 9b 9d f8 d5 ba f6 81 75 c5 35 3d 2c 65 28 f9 63 |.......u.5=,e(.c|
+| 73 1b d5 fe f9 7b 44 58 c1 45 6c 13 63 51 43 96 |s....{DX.El.cQC.|
+| 87 67 0a cc a5 ea be 2f 10 0f e6 aa b1 6b 72 ed |.g...../.....kr.|
+| ff 69 bb 9f 7e 4a 9b 49 26 bb 82 e1 95 14 b2 49 |.i..~J.I&......I|
+| 67 27 8f 0e 1d d5 b6 4e 3e 1e 62 95 a1 ac b0 9d |g'.....N>.b.....|
+| 6e 4c 5a 08 88 4f 3e eb |nLZ..O>. |
+PRF out[136]:
+| 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C|
+| 5e ba 4f 9f 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 |^.O........L.M4.|
+| fd 73 d0 45 56 d2 63 b3 92 92 9e fb d1 fb e9 80 |.s.EV.c.........|
+| 9b 9d f8 d5 ba f6 81 75 c5 35 3d 2c 65 28 f9 63 |.......u.5=,e(.c|
+| 73 1b d5 fe f9 7b 44 58 c1 45 6c 13 63 51 43 96 |s....{DX.El.cQC.|
+| 87 67 0a cc a5 ea be 2f 10 0f e6 aa b1 6b 72 ed |.g...../.....kr.|
+| ff 69 bb 9f 7e 4a 9b 49 26 bb 82 e1 95 14 b2 49 |.i..~J.I&......I|
+| 67 27 8f 0e 1d d5 b6 4e 3e 1e 62 95 a1 ac b0 9d |g'.....N>.b.....|
+| 6e 4c 5a 08 88 4f 3e eb |nLZ..O>. |
+key expansion[136]:
+| 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C|
+| 5e ba 4f 9f 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 |^.O........L.M4.|
+| fd 73 d0 45 56 d2 63 b3 92 92 9e fb d1 fb e9 80 |.s.EV.c.........|
+| 9b 9d f8 d5 ba f6 81 75 c5 35 3d 2c 65 28 f9 63 |.......u.5=,e(.c|
+| 73 1b d5 fe f9 7b 44 58 c1 45 6c 13 63 51 43 96 |s....{DX.El.cQC.|
+| 87 67 0a cc a5 ea be 2f 10 0f e6 aa b1 6b 72 ed |.g...../.....kr.|
+| ff 69 bb 9f 7e 4a 9b 49 26 bb 82 e1 95 14 b2 49 |.i..~J.I&......I|
+| 67 27 8f 0e 1d d5 b6 4e 3e 1e 62 95 a1 ac b0 9d |g'.....N>.b.....|
+| 6e 4c 5a 08 88 4f 3e eb |nLZ..O>. |
+Client MAC key[20]:
+| 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C|
+| 5e ba 4f 9f |^.O. |
+Server MAC key[20]:
+| 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 fd 73 d0 45 |.......L.M4..s.E|
+| 56 d2 63 b3 |V.c. |
+Client Write key[32]:
+| 92 92 9e fb d1 fb e9 80 9b 9d f8 d5 ba f6 81 75 |...............u|
+| c5 35 3d 2c 65 28 f9 63 73 1b d5 fe f9 7b 44 58 |.5=,e(.cs....{DX|
+Server Write key[32]:
+| c1 45 6c 13 63 51 43 96 87 67 0a cc a5 ea be 2f |.El.cQC..g...../|
+| 10 0f e6 aa b1 6b 72 ed ff 69 bb 9f 7e 4a 9b 49 |.....kr..i..~J.I|
+Client Write IV[16]:
+| 26 bb 82 e1 95 14 b2 49 67 27 8f 0e 1d d5 b6 4e |&......Ig'.....N|
+Server Write IV[16]:
+| 3e 1e 62 95 a1 ac b0 9d 6e 4c 5a 08 88 4f 3e eb |>.b.....nLZ..O>.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #218 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd29...
+looking for RSA pre-master00802f670d44d9546728ec7ccce395c6f8531f36eaf1a564...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d6 b0 54 28 1c 63 19 12 3a c6 9d ea a6 19 84 9c |..T(.c..:.......|
+| 6c 41 3e 7d 03 e8 13 c0 da 48 ae 4a dd 46 f5 f6 |lA>}.....H.J.F..|
+| 3a 58 2e 2b 16 87 b8 74 8b e2 82 9c e9 f9 28 5f |:X.+...t......(_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 ab 05 91 79 95 d3 36 41 09 de 0e 9c 4f ba a5 |....y..6A....O..|
+| 7b a3 13 99 9b cb fd 62 30 b4 30 da da 52 34 c2 |{......b0.0..R4.|
+| f1 89 1a d7 f3 82 ca b1 4a 6f e1 b6 9e ff 5f 43 |........Jo...._C|
+| b8 61 23 bd 29 6b 35 35 33 01 b5 fe 0e |.a#.)k553.... |
+hash out[136]:
+| 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/|
+| 33 52 ab c7 c4 df 69 09 b1 8d 52 80 1c 3f 74 7c |3R....i...R..?t||
+| d9 34 54 c9 e3 58 f2 14 56 11 71 1a f2 e9 b8 4f |.4T..X..V.q....O|
+| 75 6f ac 73 45 f5 b8 f6 5b 3a ec dc 7c 72 b9 32 |uo.sE...[:..|r.2|
+| 39 04 de f0 8a 20 a7 8a 82 84 80 e6 fb 56 34 04 |9.... .......V4.|
+| 34 e5 2c 7f 2f ca ae 11 cf ef 42 b3 c7 01 20 cf |4.,./.....B... .|
+| c0 84 f3 92 56 60 82 a2 57 b2 47 af fb 92 93 f1 |....V`..W.G.....|
+| 40 f3 73 f3 bb e3 55 fd 07 f0 29 4f 77 50 53 50 |@.s...U...)OwPSP|
+| 6d 81 21 f5 14 c7 cf c9 |m.!..... |
+PRF out[136]:
+| 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/|
+| 33 52 ab c7 c4 df 69 09 b1 8d 52 80 1c 3f 74 7c |3R....i...R..?t||
+| d9 34 54 c9 e3 58 f2 14 56 11 71 1a f2 e9 b8 4f |.4T..X..V.q....O|
+| 75 6f ac 73 45 f5 b8 f6 5b 3a ec dc 7c 72 b9 32 |uo.sE...[:..|r.2|
+| 39 04 de f0 8a 20 a7 8a 82 84 80 e6 fb 56 34 04 |9.... .......V4.|
+| 34 e5 2c 7f 2f ca ae 11 cf ef 42 b3 c7 01 20 cf |4.,./.....B... .|
+| c0 84 f3 92 56 60 82 a2 57 b2 47 af fb 92 93 f1 |....V`..W.G.....|
+| 40 f3 73 f3 bb e3 55 fd 07 f0 29 4f 77 50 53 50 |@.s...U...)OwPSP|
+| 6d 81 21 f5 14 c7 cf c9 |m.!..... |
+key expansion[136]:
+| 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/|
+| 33 52 ab c7 c4 df 69 09 b1 8d 52 80 1c 3f 74 7c |3R....i...R..?t||
+| d9 34 54 c9 e3 58 f2 14 56 11 71 1a f2 e9 b8 4f |.4T..X..V.q....O|
+| 75 6f ac 73 45 f5 b8 f6 5b 3a ec dc 7c 72 b9 32 |uo.sE...[:..|r.2|
+| 39 04 de f0 8a 20 a7 8a 82 84 80 e6 fb 56 34 04 |9.... .......V4.|
+| 34 e5 2c 7f 2f ca ae 11 cf ef 42 b3 c7 01 20 cf |4.,./.....B... .|
+| c0 84 f3 92 56 60 82 a2 57 b2 47 af fb 92 93 f1 |....V`..W.G.....|
+| 40 f3 73 f3 bb e3 55 fd 07 f0 29 4f 77 50 53 50 |@.s...U...)OwPSP|
+| 6d 81 21 f5 14 c7 cf c9 |m.!..... |
+Client MAC key[20]:
+| 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/|
+| 33 52 ab c7 |3R.. |
+Server MAC key[20]:
+| c4 df 69 09 b1 8d 52 80 1c 3f 74 7c d9 34 54 c9 |..i...R..?t|.4T.|
+| e3 58 f2 14 |.X.. |
+Client Write key[32]:
+| 56 11 71 1a f2 e9 b8 4f 75 6f ac 73 45 f5 b8 f6 |V.q....Ouo.sE...|
+| 5b 3a ec dc 7c 72 b9 32 39 04 de f0 8a 20 a7 8a |[:..|r.29.... ..|
+Server Write key[32]:
+| 82 84 80 e6 fb 56 34 04 34 e5 2c 7f 2f ca ae 11 |.....V4.4.,./...|
+| cf ef 42 b3 c7 01 20 cf c0 84 f3 92 56 60 82 a2 |..B... .....V`..|
+Client Write IV[16]:
+| 57 b2 47 af fb 92 93 f1 40 f3 73 f3 bb e3 55 fd |W.G.....@.s...U.|
+Server Write IV[16]:
+| 07 f0 29 4f 77 50 53 50 6d 81 21 f5 14 c7 cf c9 |..)OwPSPm.!.....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| d6 b0 54 28 1c 63 19 12 3a c6 9d ea a6 19 84 9c |..T(.c..:.......|
+| 6c 41 3e 7d 03 e8 13 c0 da 48 ae 4a dd 46 f5 f6 |lA>}.....H.J.F..|
+| 3a 58 2e 2b 16 87 b8 74 8b e2 82 9c e9 f9 28 5f |:X.+...t......(_|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 33 76 1c 9f 54 ed c6 46 30 05 fd f5 61 7e 8a ec |3v..T..F0...a~..|
+| c1 07 05 96 f8 62 aa ab 2c 8c 82 6e 4b 1b fa 81 |.....b..,..nK...|
+| 6e 21 52 79 a3 19 7c 55 ed 39 a1 5d 99 2c 9e a3 |n!Ry..|U.9.].,..|
+| 1b f9 5c 0e a5 95 aa 99 e9 7c 0b 97 fa 7e 6e a7 |..\......|...~n.|
+Plaintext[64]:
+| a0 00 69 d7 cf 98 0d a7 63 cf 75 91 89 12 bd e3 |..i.....c.u.....|
+| 14 00 00 0c ef 6f 7c 34 b9 aa ce 7a 43 83 e1 93 |.....o|4...zC...|
+| ff bd 4d 23 a4 c9 0b 2b 85 4b c6 5f 61 ef 07 3a |..M#...+.K._a..:|
+| 2e d6 5f 37 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.._7............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ff bd 4d 23 a4 c9 0b 2b 85 4b c6 5f 61 ef 07 3a |..M#...+.K._a..:|
+| 2e d6 5f 37 |.._7 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #219 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a3 e4 69 91 f0 2a fe 4c 8a 92 22 06 ba 92 64 2e |..i..*.L.."...d.|
+| d4 e5 4b 94 af 0b bd bc c7 41 cb 79 bb 50 8d 10 |..K......A.y.P..|
+| 5a 12 ed 1f 06 42 e3 40 16 21 4c 27 0e bd 01 3a |Z....B.@.!L'...:|
+| dd 77 da e9 c0 b6 bd 32 8a 86 7e 5d b8 a5 26 49 |.w.....2..~]..&I|
+Plaintext[64]:
+| 2b 50 de 96 ba d2 a8 d6 92 d3 ce df f4 38 14 0e |+P...........8..|
+| 14 00 00 0c 7a 7e 50 96 14 70 c4 c5 b0 cf 39 bd |....z~P..p....9.|
+| b0 c8 0e 95 47 fd 0c 18 96 cd 02 f7 97 90 13 0c |....G...........|
+| 04 bd 98 43 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...C............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b0 c8 0e 95 47 fd 0c 18 96 cd 02 f7 97 90 13 0c |....G...........|
+| 04 bd 98 43 |...C |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #220 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 95 b6 63 f7 01 ca f8 3d 4a e1 8e 11 48 12 9d 16 |..c....=J...H...|
+| 24 d4 a5 bb 81 e7 2a 04 ac 3a 2b 33 74 e1 ff 36 |$.....*..:+3t..6|
+| 7b 9b 94 8a b3 f8 67 9e 2e e2 e6 99 5b d7 15 3c |{.....g.....[..<|
+| 90 03 a8 10 79 07 0f a6 cc 94 37 9d af ea 02 55 |....y.....7....U|
+| 91 b6 dd a8 2a 42 c1 fd 4c 0f 0a 8c 3c 0e a4 82 |....*B..L...<...|
+| 8d 09 47 95 60 2b 09 96 6c 30 06 5d bf ba 9e b1 |..G.`+..l0.]....|
+| 22 52 7f 26 8a 5f 91 91 3c 2b f8 1f 27 88 af 44 |"R.&._..<+..'..D|
+Plaintext[112]:
+| 3c 74 52 56 78 89 9a a1 bc 23 d2 5b d2 0b fa c5 |<tRVx....#.[....|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 33 0d 0a 0d 0a e6 de bc 8d 9d 41 d7 16 |4453.........A..|
+| 7b 77 fb fc 96 e7 c2 c3 6c 0e 4d ae 03 03 03 03 |{w......l.M.....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2a db 43 e6 f4 2b 26 0f a8 c7 4e 44 3d 52 e0 af |*.C..+&...ND=R..|
+| 88 dd 65 6b |..ek |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52902 found (nil)
+association_find: TCP port 4453 found 0x27eec50
+
+dissect_ssl enter frame #221 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 0a 21 2c d9 e8 cc ed 4c 64 04 e5 8c 62 9b 11 09 |.!,....Ld...b...|
+| fc c6 2c e7 2d fe ee f2 fd 69 24 93 41 d4 e2 46 |..,.-....i$.A..F|
+| dc de 32 5c 10 d3 1c e5 6a 9e ca 7f ec 8d 17 50 |..2\....j......P|
+| 40 b0 a0 71 c9 25 01 b3 c1 cf a8 51 77 9c 15 ed |@..q.%.....Qw...|
+| 3c 53 ad 5c 62 51 00 31 ac 4b 5b 8f 80 a4 92 20 |<S.\bQ.1.K[.... |
+| d8 ac 7c e3 63 68 06 a6 17 6f 04 64 ad 1b ee 2e |..|.ch...o.d....|
+| da 08 3f e5 d7 5f 91 ee fe ff dc fe 21 d7 5d ee |..?.._......!.].|
+| bd a0 2b f9 ff 37 f7 57 b2 58 21 ea 14 8e a6 4c |..+..7.W.X!....L|
+| a6 86 ae 44 f5 7b 47 e6 d2 c2 b3 64 9f 38 13 af |...D.{G....d.8..|
+| f1 b3 41 0d 09 3c f0 6d 21 4e f5 98 17 74 8b 29 |..A..<.m!N...t.)|
+| 1f 20 2a 57 e3 55 12 93 ac da dc b1 2c 6e f3 04 |. *W.U......,n..|
+| 9f eb ba f7 ae 6c 65 bb 8c 42 10 4e e6 3b 9b f1 |.....le..B.N.;..|
+| f1 a8 f0 7d 0f c2 82 97 27 e9 ad 09 c7 47 1f 52 |...}....'....G.R|
+| 18 38 21 e0 1c bc a2 b9 af de 58 90 ed 62 3a 02 |.8!.......X..b:.|
+| b9 ff ab 3a a8 4d e4 c7 5d a2 ad f4 c3 47 74 41 |...:.M..]....GtA|
+| 40 b3 62 67 5e 70 2b 8f 4e 66 00 6a b4 54 5b d8 |@.bg^p+.Nf.j.T[.|
+| 9d 20 4c d1 58 e6 68 4c ad 45 df 7a 3e e2 23 de |. L.X.hL.E.z>.#.|
+| a1 16 83 d3 a3 16 a1 04 db 9b ac d7 e3 e0 e8 3a |...............:|
+| 0e 81 eb 30 7b 1e 52 63 94 e5 c0 33 57 46 49 35 |...0{.Rc...3WFI5|
+| 3b d5 a7 c1 38 5b 0f ae e4 e5 a8 ed 52 8c c1 01 |;...8[......R...|
+| b2 2e 46 d2 f2 8b 3c 2d 77 25 5e 3c f9 bd fe 93 |..F...<-w%^<....|
+| 85 0f 18 08 09 74 c3 67 2d 83 77 e2 6c 65 d3 3f |.....t.g-.w.le.?|
+| dc 2b b2 4e 10 7d b5 3b dd 2e 27 b1 b1 0c c9 a2 |.+.N.}.;..'.....|
+| d6 b0 73 9e b5 c6 a6 d8 0e 5a 5f c2 75 1b e8 7f |..s......Z_.u...|
+| 12 5e 64 12 e7 4e 49 50 e6 11 ee 29 58 5a 88 64 |.^d..NIP...)XZ.d|
+Plaintext[400]:
+| 37 13 02 57 db df 7c fb d0 f8 4a fb fc 75 4a d3 |7..W..|...J..uJ.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R|
+| 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e bc 06 a3 e3 |nl'</script>....|
+| f3 63 3c 01 a9 a5 df 74 fb 01 82 43 fc 18 2c a8 |.c<....t...C..,.|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cb 87 cd ec 7c c0 af b9 50 6c 19 03 aa 61 23 a5 |....|...Pl...a#.|
+| bb d5 7d 13 |..}. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4453 found 0x27eec50
+
+dissect_ssl enter frame #222 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 55 7d 22 af 8f a7 fc b2 ad 2a bc 1f 60 92 51 3e |U}"......*..`.Q>|
+| 43 a6 d0 e5 42 4c 40 d6 ae ab b5 53 bb 0d d0 92 |C...BL@....S....|
+| 25 6e f7 ec 5f fd f0 55 b1 c4 75 16 f1 86 a3 4a |%n.._..U..u....J|
+Plaintext[48]:
+| 40 e4 bf 34 94 24 10 8d e5 d0 9b c5 9a 14 85 28 |@..4.$.........(|
+| 01 00 07 09 c1 b1 a5 a6 54 41 8d ee 75 e0 4e 79 |........TA..u.Ny|
+| 57 c9 dc e9 e0 77 09 09 09 09 09 09 09 09 09 09 |W....w..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 07 09 c1 b1 a5 a6 54 41 8d ee 75 e0 4e 79 57 c9 |......TA..u.NyW.|
+| dc e9 e0 77 |...w |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #224 (first time)
+ conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 95 8b fa 12 0a b2 30 82 17 41 7c 1e 58 5e e6 9c |......0..A|.X^..|
+| 2a 18 31 91 41 f0 c1 21 a1 1f b2 b7 d6 f9 6a a4 |*.1.A..!......j.|
+| eb 0e 27 af d1 96 68 d4 f4 06 d8 c5 5d e2 a3 45 |..'...h.....]..E|
+Plaintext[48]:
+| d5 62 4f ee 8d 44 90 f8 c8 bb b0 e4 bc 0e a3 09 |.bO..D..........|
+| 01 00 74 9e a0 4a cf 56 6e 6d f9 67 d8 da 4d 75 |..t..J.Vnm.g..Mu|
+| 61 c8 a2 ec 0b 1f 09 09 09 09 09 09 09 09 09 09 |a...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 9e a0 4a cf 56 6e 6d f9 67 d8 da 4d 75 61 c8 |t..J.Vnm.g..Mua.|
+| a2 ec 0b 1f |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #229 (first time)
+ssl_session_init: initializing ptr 0x7fca45be9960 size 688
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50418 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4457
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #231 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d6 b0 54 28 1c 63 19 12 3a c6 9d ea a6 19 84 9c |..T(.c..:.......|
+| 6c 41 3e 7d 03 e8 13 c0 da 48 ae 4a dd 46 f5 f6 |lA>}.....H.J.F..|
+| 3a 58 2e 2b 16 87 b8 74 8b e2 82 9c e9 f9 28 5f |:X.+...t......(_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 92 61 7e a8 7f ca 24 7d 17 34 2b 23 ad 77 d8 |..a~...$}.4+#.w.|
+| 9c 3c 66 7b 26 aa 7b 15 ab 59 99 64 d4 52 34 c2 |.<f{&.{..Y.d.R4.|
+| f1 7e 34 bb a1 b8 a7 04 53 43 f0 67 9e e4 dc 85 |.~4.....SC.g....|
+| 39 fe bb c8 7f 1b 20 27 2f ca 95 b8 83 |9..... '/.... |
+hash out[104]:
+| 6f 6c 37 f0 c3 cf 67 5a b8 0d 8b 92 62 0c cc 22 |ol7...gZ....b.."|
+| 48 04 7d 01 2f 7b 8b 8e 1d 5b b7 01 eb d9 b4 5a |H.}./{...[.....Z|
+| 36 c4 96 ee de 1b 4e eb a6 2f e7 b3 f9 08 c0 2f |6.....N../...../|
+| 73 7f 7a b1 09 7a 49 b0 9c 3a 20 e7 f3 c3 a3 ad |s.z..zI..: .....|
+| 7d 2d 33 4b 1e 23 bf a6 a4 56 45 be bc 6b 32 d0 |}-3K.#...VE..k2.|
+| b5 db 84 d2 87 20 07 c3 69 3d 94 f4 44 42 16 2a |..... ..i=..DB.*|
+| c6 17 db 64 01 34 30 3f |...d.40? |
+PRF out[104]:
+| 6f 6c 37 f0 c3 cf 67 5a b8 0d 8b 92 62 0c cc 22 |ol7...gZ....b.."|
+| 48 04 7d 01 2f 7b 8b 8e 1d 5b b7 01 eb d9 b4 5a |H.}./{...[.....Z|
+| 36 c4 96 ee de 1b 4e eb a6 2f e7 b3 f9 08 c0 2f |6.....N../...../|
+| 73 7f 7a b1 09 7a 49 b0 9c 3a 20 e7 f3 c3 a3 ad |s.z..zI..: .....|
+| 7d 2d 33 4b 1e 23 bf a6 a4 56 45 be bc 6b 32 d0 |}-3K.#...VE..k2.|
+| b5 db 84 d2 87 20 07 c3 69 3d 94 f4 44 42 16 2a |..... ..i=..DB.*|
+| c6 17 db 64 01 34 30 3f |...d.40? |
+key expansion[104]:
+| 6f 6c 37 f0 c3 cf 67 5a b8 0d 8b 92 62 0c cc 22 |ol7...gZ....b.."|
+| 48 04 7d 01 2f 7b 8b 8e 1d 5b b7 01 eb d9 b4 5a |H.}./{...[.....Z|
+| 36 c4 96 ee de 1b 4e eb a6 2f e7 b3 f9 08 c0 2f |6.....N../...../|
+| 73 7f 7a b1 09 7a 49 b0 9c 3a 20 e7 f3 c3 a3 ad |s.z..zI..: .....|
+| 7d 2d 33 4b 1e 23 bf a6 a4 56 45 be bc 6b 32 d0 |}-3K.#...VE..k2.|
+| b5 db 84 d2 87 20 07 c3 69 3d 94 f4 44 42 16 2a |..... ..i=..DB.*|
+| c6 17 db 64 01 34 30 3f |...d.40? |
+Client MAC key[20]:
+| 6f 6c 37 f0 c3 cf 67 5a b8 0d 8b 92 62 0c cc 22 |ol7...gZ....b.."|
+| 48 04 7d 01 |H.}. |
+Server MAC key[20]:
+| 2f 7b 8b 8e 1d 5b b7 01 eb d9 b4 5a 36 c4 96 ee |/{...[.....Z6...|
+| de 1b 4e eb |..N. |
+Client Write key[16]:
+| a6 2f e7 b3 f9 08 c0 2f 73 7f 7a b1 09 7a 49 b0 |./...../s.z..zI.|
+Server Write key[16]:
+| 9c 3a 20 e7 f3 c3 a3 ad 7d 2d 33 4b 1e 23 bf a6 |.: .....}-3K.#..|
+Client Write IV[16]:
+| a4 56 45 be bc 6b 32 d0 b5 db 84 d2 87 20 07 c3 |.VE..k2...... ..|
+Server Write IV[16]:
+| 69 3d 94 f4 44 42 16 2a c6 17 db 64 01 34 30 3f |i=..DB.*...d.40?|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #233 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f...
+looking for RSA pre-master459ec8d6ec5b4d47f4b16f271d9f2a256a1a1f283f1460c3...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e1 1c 3c fc 6f 8b a7 fe 2d f3 ad 7f 47 b8 e0 db |..<.o...-...G...|
+| 3e 51 a8 9a eb 20 8c 45 c0 3d ce e3 b7 9d c8 dc |>Q... .E.=......|
+| 14 06 67 03 60 fb d1 dc 5c b4 60 97 cf 1f 66 e6 |..g.`...\.`...f.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 92 61 7e a8 7f ca 24 7d 17 34 2b 23 ad 77 d8 |..a~...$}.4+#.w.|
+| 9c 3c 66 7b 26 aa 7b 15 ab 59 99 64 d4 52 34 c2 |.<f{&.{..Y.d.R4.|
+| f1 7e 34 bb a1 b8 a7 04 53 43 f0 67 9e e4 dc 85 |.~4.....SC.g....|
+| 39 fe bb c8 7f 1b 20 27 2f ca 95 b8 83 |9..... '/.... |
+hash out[104]:
+| df 31 1a 78 40 e1 b9 92 35 c6 a3 44 74 08 68 d8 |.1.x@...5..Dt.h.|
+| 93 90 79 86 53 d3 ff d4 d3 0e f3 ff f4 19 a9 ec |..y.S...........|
+| 33 21 f3 97 96 5f 08 20 5e c9 ae af 4e 54 f2 8b |3!..._. ^...NT..|
+| 91 67 4a f8 22 ea bb 24 7a 5a 6a d7 83 1e d1 5d |.gJ."..$zZj....]|
+| 4a bc 1a aa 86 b3 70 fa 54 8c e6 d6 44 03 72 6f |J.....p.T...D.ro|
+| 54 bd 85 bd 5c a4 49 01 d1 c7 28 73 72 cc 8d 26 |T...\.I...(sr..&|
+| cb 4b 60 89 04 d4 0d 5d |.K`....] |
+PRF out[104]:
+| df 31 1a 78 40 e1 b9 92 35 c6 a3 44 74 08 68 d8 |.1.x@...5..Dt.h.|
+| 93 90 79 86 53 d3 ff d4 d3 0e f3 ff f4 19 a9 ec |..y.S...........|
+| 33 21 f3 97 96 5f 08 20 5e c9 ae af 4e 54 f2 8b |3!..._. ^...NT..|
+| 91 67 4a f8 22 ea bb 24 7a 5a 6a d7 83 1e d1 5d |.gJ."..$zZj....]|
+| 4a bc 1a aa 86 b3 70 fa 54 8c e6 d6 44 03 72 6f |J.....p.T...D.ro|
+| 54 bd 85 bd 5c a4 49 01 d1 c7 28 73 72 cc 8d 26 |T...\.I...(sr..&|
+| cb 4b 60 89 04 d4 0d 5d |.K`....] |
+key expansion[104]:
+| df 31 1a 78 40 e1 b9 92 35 c6 a3 44 74 08 68 d8 |.1.x@...5..Dt.h.|
+| 93 90 79 86 53 d3 ff d4 d3 0e f3 ff f4 19 a9 ec |..y.S...........|
+| 33 21 f3 97 96 5f 08 20 5e c9 ae af 4e 54 f2 8b |3!..._. ^...NT..|
+| 91 67 4a f8 22 ea bb 24 7a 5a 6a d7 83 1e d1 5d |.gJ."..$zZj....]|
+| 4a bc 1a aa 86 b3 70 fa 54 8c e6 d6 44 03 72 6f |J.....p.T...D.ro|
+| 54 bd 85 bd 5c a4 49 01 d1 c7 28 73 72 cc 8d 26 |T...\.I...(sr..&|
+| cb 4b 60 89 04 d4 0d 5d |.K`....] |
+Client MAC key[20]:
+| df 31 1a 78 40 e1 b9 92 35 c6 a3 44 74 08 68 d8 |.1.x@...5..Dt.h.|
+| 93 90 79 86 |..y. |
+Server MAC key[20]:
+| 53 d3 ff d4 d3 0e f3 ff f4 19 a9 ec 33 21 f3 97 |S...........3!..|
+| 96 5f 08 20 |._. |
+Client Write key[16]:
+| 5e c9 ae af 4e 54 f2 8b 91 67 4a f8 22 ea bb 24 |^...NT...gJ."..$|
+Server Write key[16]:
+| 7a 5a 6a d7 83 1e d1 5d 4a bc 1a aa 86 b3 70 fa |zZj....]J.....p.|
+Client Write IV[16]:
+| 54 8c e6 d6 44 03 72 6f 54 bd 85 bd 5c a4 49 01 |T...D.roT...\.I.|
+Server Write IV[16]:
+| d1 c7 28 73 72 cc 8d 26 cb 4b 60 89 04 d4 0d 5d |..(sr..&.K`....]|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| e1 1c 3c fc 6f 8b a7 fe 2d f3 ad 7f 47 b8 e0 db |..<.o...-...G...|
+| 3e 51 a8 9a eb 20 8c 45 c0 3d ce e3 b7 9d c8 dc |>Q... .E.=......|
+| 14 06 67 03 60 fb d1 dc 5c b4 60 97 cf 1f 66 e6 |..g.`...\.`...f.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 4c 52 62 cc f5 43 03 9b 63 64 91 ee 29 a7 2e 9d |LRb..C..cd..)...|
+| 8f 9c 44 0e 3d 88 02 6b 8d c5 4c 0f 73 55 3f 86 |..D.=..k..L.sU?.|
+| 55 c2 d4 7b 91 7d 4f 81 8f 54 ed 83 8a c3 bb 5a |U..{.}O..T.....Z|
+| 08 25 de 3a 45 74 1b 81 5b 42 71 59 8b 87 c9 e0 |.%.:Et..[BqY....|
+Plaintext[64]:
+| 47 e1 f7 1f f2 f2 8c 7a a7 ee fd 91 ce f3 16 25 |G......z.......%|
+| 14 00 00 0c f7 73 9c d2 47 e7 0b e5 99 a5 36 20 |.....s..G.....6 |
+| 01 e0 1b 9e a6 f0 4a d9 48 6f ce fe 98 68 86 a9 |......J.Ho...h..|
+| 9d 3e 0f ff 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.>..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 01 e0 1b 9e a6 f0 4a d9 48 6f ce fe 98 68 86 a9 |......J.Ho...h..|
+| 9d 3e 0f ff |.>.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #234 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 21 84 91 76 36 39 e8 f5 58 29 24 a4 78 7b 7d ae |!..v69..X)$.x{}.|
+| be b6 62 28 c5 e0 07 2b c2 75 b4 c9 18 84 af b1 |..b(...+.u......|
+| 93 43 4c 26 b8 72 5f fb 0f f2 52 15 fd b5 b9 a0 |.CL&.r_...R.....|
+| f4 54 e8 dd 01 b8 83 43 a2 b4 43 bf 52 08 c4 2b |.T.....C..C.R..+|
+Plaintext[64]:
+| 4c ba 74 4b 8b a3 e5 d0 3c b5 ed fa 54 e3 d1 d7 |L.tK....<...T...|
+| 14 00 00 0c 12 fe f4 ad c6 d7 6e 99 9c bb 85 5b |..........n....[|
+| 0f 15 1c 3c 37 4e b8 f0 c7 f4 86 6b 7e 49 f2 75 |...<7N.....k~I.u|
+| 48 07 c0 59 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |H..Y............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0f 15 1c 3c 37 4e b8 f0 c7 f4 86 6b 7e 49 f2 75 |...<7N.....k~I.u|
+| 48 07 c0 59 |H..Y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #235 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| b3 af ce 00 71 67 a3 2e 0c a4 c3 34 c5 fe 5a 24 |....qg.....4..Z$|
+| bb a0 76 0e 1d 44 28 d1 7a 05 27 1d 30 df 87 5e |..v..D(.z.'.0..^|
+| 0f 70 fe db f3 9a b1 82 98 e6 c6 34 f9 81 4a 69 |.p.........4..Ji|
+| 57 f9 b1 22 e8 b8 da 80 e0 a8 86 e5 b7 89 86 4a |W.."...........J|
+| ce 0b ea 26 51 74 80 77 a9 a0 b1 ee 30 8e 52 42 |...&Qt.w....0.RB|
+| c2 2a 19 f5 1d 57 6c 87 da 18 00 49 3e e4 13 b5 |.*...Wl....I>...|
+| c1 c9 53 24 9c 61 f3 a7 8e e9 7b b4 14 3a 86 4f |..S$.a....{..:.O|
+Plaintext[112]:
+| 5e 15 3b 1b 0e ae cb 39 29 46 d4 af 1f a5 5d 13 |^.;....9)F....].|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12|
+| 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445|
+| 37 0d 0a 0d 0a 1d b9 f8 3c b2 25 8b f3 f1 e1 09 |7.......<.%.....|
+| 50 45 72 fa 30 0e 8e 67 23 06 06 06 06 06 06 06 |PEr.0..g#.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 93 72 a1 b8 94 41 e3 ad 22 f5 23 98 d2 0d 6d c0 |.r...A..".#...m.|
+| 50 c5 12 cf |P... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50418 found (nil)
+association_find: TCP port 4457 found 0x3734c50
+
+dissect_ssl enter frame #236 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 91 7d b3 4a d4 1c a5 3c 34 86 de 58 55 32 85 b1 |.}.J...<4..XU2..|
+| b3 b6 a5 f3 06 24 fe 56 93 2b 3c df 74 9a aa ef |.....$.V.+<.t...|
+| 03 b2 57 e8 f2 59 c8 de 27 13 8f c5 d6 2f 48 1d |..W..Y..'..../H.|
+| ce 86 a2 79 c2 7d 06 40 42 d9 4b a1 7e 2c 26 9d |...y.}.@B.K.~,&.|
+| cd a8 1e 44 2b a7 be cf 15 71 95 bb e6 c5 52 5d |...D+....q....R]|
+| 9b 9a 97 fa fd 4f cd 03 ac ba bd fe db c8 82 70 |.....O.........p|
+| df 0a 67 34 05 8c 3d 0e 05 de e7 b7 43 6f 87 d4 |..g4..=.....Co..|
+| 07 cc c8 b6 d2 4f 7c ba 51 b7 da d1 0c 66 10 f7 |.....O|.Q....f..|
+| 70 ea 6d db bf f5 78 47 9b 9b e5 67 20 01 2f 08 |p.m...xG...g ./.|
+| 6e 6b 86 ef 7d d8 15 76 c0 14 18 f1 f0 da 1f 00 |nk..}..v........|
+| 1f 44 62 21 ba a5 a5 c5 6b fb df 4c 89 f4 e3 89 |.Db!....k..L....|
+| 75 74 04 d6 8a 62 72 0a 06 03 97 c3 0c 6b e6 f7 |ut...br......k..|
+| b5 fb 0e d0 cf 9f c9 a2 89 29 7d f2 5d b7 30 f7 |.........)}.].0.|
+| e3 ee 05 3d 5d c7 a9 44 1e 59 bf 64 27 95 10 fb |...=]..D.Y.d'...|
+| ce e3 e4 1f df a5 84 7e c0 93 80 95 08 51 e5 9f |.......~.....Q..|
+| 4e fe af 9f 8a a2 3a 7a 97 3e 40 82 fc 49 d5 1d |N.....:z.>@..I..|
+| 07 3f f9 bc c0 dc a3 19 05 33 c3 4f 96 dc 9f 53 |.?.......3.O...S|
+| f8 44 fc 68 35 aa 2e f5 4a 1c 70 66 51 40 57 85 |.D.h5...J.pfQ@W.|
+| 2a 6b 7f 70 db ec 8a de b2 f7 a8 4f 76 d0 27 ec |*k.p.......Ov.'.|
+| ce 1b 1b 45 ac 30 5c 21 93 47 db bc 2f 11 20 ae |...E.0\!.G../. .|
+| 20 d2 35 6c df 3f 86 b2 0f 35 76 19 b7 5c f0 e3 | .5l.?...5v..\..|
+| 25 78 1c 08 18 ac d1 b4 01 3c 9f f6 0b f6 dc 42 |%x.......<.....B|
+| 61 0b 9b 1c f4 32 73 3d 5c 32 05 fb 76 45 b4 0a |a....2s=\2..vE..|
+| ed ad 6a 5d e4 c2 24 e1 d4 55 f2 32 af 5e aa 18 |..j]..$..U.2.^..|
+| 1c 5e 7e 5e 04 31 13 7b ec 80 8e 2b 17 30 70 40 |.^~^.1.{...+.0p@|
+Plaintext[400]:
+| f6 84 48 3c b6 d0 a7 9c d9 53 2a 5f 11 5b b0 26 |..H<.....S*_.[.&|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL|
+| 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| c7 d8 31 39 a7 3e 12 d8 32 94 ff 04 fa a7 b7 be |..19.>..2.......|
+| 17 c4 d5 1c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e7 62 c6 c4 da 66 91 8e 90 cc f7 12 f2 be 15 0f |.b...f..........|
+| 72 8e ab 42 |r..B |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4457 found 0x3734c50
+
+dissect_ssl enter frame #237 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 38 12 e6 31 8a 8e a3 93 84 af 5e 48 8c ac fe ca |8..1......^H....|
+| ae 52 4f 40 c5 6c 5d bc f3 42 ae 1e e3 3a f3 eb |.RO@.l]..B...:..|
+| 9d 8d 96 7c 74 07 b8 ab d6 4a b6 10 04 1c 83 47 |...|t....J.....G|
+Plaintext[48]:
+| 7e e4 86 0a 30 a5 05 09 1b d7 3b f2 50 7c a3 14 |~...0.....;.P|..|
+| 01 00 9c e5 7c 9e 4a 68 88 d7 60 9f e9 bb f2 b2 |....|.Jh..`.....|
+| 1e 90 bd ee dd d2 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c e5 7c 9e 4a 68 88 d7 60 9f e9 bb f2 b2 1e 90 |..|.Jh..`.......|
+| bd ee dd d2 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #239 (first time)
+ conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 35 0a 96 e3 90 69 29 d2 19 dc fd 0f 4b f1 de 23 |5....i).....K..#|
+| ca c4 fb 34 07 3d ca cb 37 89 d5 3b b4 46 61 9d |...4.=..7..;.Fa.|
+| c2 b1 df 0b 08 76 20 3b 96 d0 f9 63 6e 33 75 65 |.....v ;...cn3ue|
+Plaintext[48]:
+| eb 38 8c 26 0c 48 fe 13 51 a0 23 59 39 69 b4 35 |.8.&.H..Q.#Y9i.5|
+| 01 00 33 dd ce 87 23 35 f9 1e f4 e0 d1 21 dc 6b |..3...#5.....!.k|
+| af 63 dc 34 cd 99 09 09 09 09 09 09 09 09 09 09 |.c.4............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 dd ce 87 23 35 f9 1e f4 e0 d1 21 dc 6b af 63 |3...#5.....!.k.c|
+| dc 34 cd 99 |.4.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #244 (first time)
+ssl_session_init: initializing ptr 0x7fca45bebee0 size 688
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44831 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4458
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #246 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e1 1c 3c fc 6f 8b a7 fe 2d f3 ad 7f 47 b8 e0 db |..<.o...-...G...|
+| 3e 51 a8 9a eb 20 8c 45 c0 3d ce e3 b7 9d c8 dc |>Q... .E.=......|
+| 14 06 67 03 60 fb d1 dc 5c b4 60 97 cf 1f 66 e6 |..g.`...\.`...f.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 4d 90 9b 21 34 3d 9c ab 54 85 19 3f a1 67 bd |.M..!4=..T..?.g.|
+| 3a f8 05 12 cc 1b ac 16 6f db ea 96 84 52 34 c2 |:.......o....R4.|
+| f1 86 8c db ab aa 51 7f 0b 47 0c 34 81 34 05 e8 |......Q..G.4.4..|
+| 92 08 38 77 ef 52 1a 6d 1f 6b f2 01 8c |..8w.R.m.k... |
+hash out[104]:
+| 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....|
+| ad 72 80 84 af 6c 7c 76 b4 6d da d3 46 8c c1 3c |.r...l|v.m..F..<|
+| bd d2 84 2a f4 c7 0e 00 d7 72 fc 3b 26 6e 79 56 |...*.....r.;&nyV|
+| 95 2e 57 b1 74 6c 83 9a 68 c7 d1 da 89 0c 59 54 |..W.tl..h.....YT|
+| 66 95 36 ce b8 5a f0 e1 24 36 be 0a b4 56 af e4 |f.6..Z..$6...V..|
+| d5 f8 c4 03 1c d9 fb b1 a5 62 45 17 02 d4 28 d1 |.........bE...(.|
+| 9a 60 fe 15 19 8b 60 ae |.`....`. |
+PRF out[104]:
+| 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....|
+| ad 72 80 84 af 6c 7c 76 b4 6d da d3 46 8c c1 3c |.r...l|v.m..F..<|
+| bd d2 84 2a f4 c7 0e 00 d7 72 fc 3b 26 6e 79 56 |...*.....r.;&nyV|
+| 95 2e 57 b1 74 6c 83 9a 68 c7 d1 da 89 0c 59 54 |..W.tl..h.....YT|
+| 66 95 36 ce b8 5a f0 e1 24 36 be 0a b4 56 af e4 |f.6..Z..$6...V..|
+| d5 f8 c4 03 1c d9 fb b1 a5 62 45 17 02 d4 28 d1 |.........bE...(.|
+| 9a 60 fe 15 19 8b 60 ae |.`....`. |
+key expansion[104]:
+| 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....|
+| ad 72 80 84 af 6c 7c 76 b4 6d da d3 46 8c c1 3c |.r...l|v.m..F..<|
+| bd d2 84 2a f4 c7 0e 00 d7 72 fc 3b 26 6e 79 56 |...*.....r.;&nyV|
+| 95 2e 57 b1 74 6c 83 9a 68 c7 d1 da 89 0c 59 54 |..W.tl..h.....YT|
+| 66 95 36 ce b8 5a f0 e1 24 36 be 0a b4 56 af e4 |f.6..Z..$6...V..|
+| d5 f8 c4 03 1c d9 fb b1 a5 62 45 17 02 d4 28 d1 |.........bE...(.|
+| 9a 60 fe 15 19 8b 60 ae |.`....`. |
+Client MAC key[20]:
+| 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....|
+| ad 72 80 84 |.r.. |
+Server MAC key[20]:
+| af 6c 7c 76 b4 6d da d3 46 8c c1 3c bd d2 84 2a |.l|v.m..F..<...*|
+| f4 c7 0e 00 |.... |
+Client Write key[16]:
+| d7 72 fc 3b 26 6e 79 56 95 2e 57 b1 74 6c 83 9a |.r.;&nyV..W.tl..|
+Server Write key[16]:
+| 68 c7 d1 da 89 0c 59 54 66 95 36 ce b8 5a f0 e1 |h.....YTf.6..Z..|
+Client Write IV[16]:
+| 24 36 be 0a b4 56 af e4 d5 f8 c4 03 1c d9 fb b1 |$6...V..........|
+Server Write IV[16]:
+| a5 62 45 17 02 d4 28 d1 9a 60 fe 15 19 8b 60 ae |.bE...(..`....`.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #248 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef...
+looking for RSA pre-master0080017403ec9beab40874d420b636c528a422d3f5a04f90...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bf b3 a6 e2 2a 71 ee 4a 90 54 a4 55 87 d9 a1 f9 |....*q.J.T.U....|
+| 9b 7c 7c 10 7b f0 49 1e 55 1c 67 6d c3 d4 6b a1 |.||.{.I.U.gm..k.|
+| ac 86 b4 de 39 47 58 4c ad 09 d1 5f b2 4f bb 91 |....9GXL..._.O..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 4d 90 9b 21 34 3d 9c ab 54 85 19 3f a1 67 bd |.M..!4=..T..?.g.|
+| 3a f8 05 12 cc 1b ac 16 6f db ea 96 84 52 34 c2 |:.......o....R4.|
+| f1 86 8c db ab aa 51 7f 0b 47 0c 34 81 34 05 e8 |......Q..G.4.4..|
+| 92 08 38 77 ef 52 1a 6d 1f 6b f2 01 8c |..8w.R.m.k... |
+hash out[104]:
+| 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...|
+| 96 28 6d 6f 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc |.(mo..)...z.....|
+| 35 f1 84 83 d7 bd 3e 95 02 c7 a8 2e c8 8c d8 4c |5.....>........L|
+| 96 76 ed 03 ae 66 11 66 3d 30 31 dc 10 08 ec 72 |.v...f.f=01....r|
+| 0c 7a 8c ea dc 03 d1 bc a2 47 f7 dc b6 5c 61 3a |.z.......G...\a:|
+| 52 6e b9 55 f0 f9 0d 95 1f 98 e6 a4 b5 7a 1b 00 |Rn.U.........z..|
+| ff 9a 24 3d 66 b8 8e 3c |..$=f..< |
+PRF out[104]:
+| 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...|
+| 96 28 6d 6f 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc |.(mo..)...z.....|
+| 35 f1 84 83 d7 bd 3e 95 02 c7 a8 2e c8 8c d8 4c |5.....>........L|
+| 96 76 ed 03 ae 66 11 66 3d 30 31 dc 10 08 ec 72 |.v...f.f=01....r|
+| 0c 7a 8c ea dc 03 d1 bc a2 47 f7 dc b6 5c 61 3a |.z.......G...\a:|
+| 52 6e b9 55 f0 f9 0d 95 1f 98 e6 a4 b5 7a 1b 00 |Rn.U.........z..|
+| ff 9a 24 3d 66 b8 8e 3c |..$=f..< |
+key expansion[104]:
+| 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...|
+| 96 28 6d 6f 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc |.(mo..)...z.....|
+| 35 f1 84 83 d7 bd 3e 95 02 c7 a8 2e c8 8c d8 4c |5.....>........L|
+| 96 76 ed 03 ae 66 11 66 3d 30 31 dc 10 08 ec 72 |.v...f.f=01....r|
+| 0c 7a 8c ea dc 03 d1 bc a2 47 f7 dc b6 5c 61 3a |.z.......G...\a:|
+| 52 6e b9 55 f0 f9 0d 95 1f 98 e6 a4 b5 7a 1b 00 |Rn.U.........z..|
+| ff 9a 24 3d 66 b8 8e 3c |..$=f..< |
+Client MAC key[20]:
+| 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...|
+| 96 28 6d 6f |.(mo |
+Server MAC key[20]:
+| 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc 35 f1 84 83 |..)...z.....5...|
+| d7 bd 3e 95 |..>. |
+Client Write key[16]:
+| 02 c7 a8 2e c8 8c d8 4c 96 76 ed 03 ae 66 11 66 |.......L.v...f.f|
+Server Write key[16]:
+| 3d 30 31 dc 10 08 ec 72 0c 7a 8c ea dc 03 d1 bc |=01....r.z......|
+Client Write IV[16]:
+| a2 47 f7 dc b6 5c 61 3a 52 6e b9 55 f0 f9 0d 95 |.G...\a:Rn.U....|
+Server Write IV[16]:
+| 1f 98 e6 a4 b5 7a 1b 00 ff 9a 24 3d 66 b8 8e 3c |.....z....$=f..<|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| bf b3 a6 e2 2a 71 ee 4a 90 54 a4 55 87 d9 a1 f9 |....*q.J.T.U....|
+| 9b 7c 7c 10 7b f0 49 1e 55 1c 67 6d c3 d4 6b a1 |.||.{.I.U.gm..k.|
+| ac 86 b4 de 39 47 58 4c ad 09 d1 5f b2 4f bb 91 |....9GXL..._.O..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| dc d3 ed 83 82 a6 c9 e9 ad 4f 65 a6 00 d3 09 f6 |.........Oe.....|
+| 8f 51 8a d6 eb 33 3a fd 21 99 ab 6d 67 3d 5e 1b |.Q...3:.!..mg=^.|
+| c7 63 f4 d7 eb ff 82 86 f4 b9 5b 31 d0 20 bf bf |.c........[1. ..|
+| da a0 4f 65 5f 3b 89 e7 0c 41 2f 42 eb 10 30 3d |..Oe_;...A/B..0=|
+Plaintext[64]:
+| 71 28 e6 92 85 a4 ae d3 8f cf 3b fa f2 7f fd c9 |q(........;.....|
+| 14 00 00 0c 98 24 e4 05 59 5d 00 af b9 c5 b6 2c |.....$..Y].....,|
+| 34 1f ec c4 43 2d ed c1 21 08 69 85 98 67 b9 ce |4...C-..!.i..g..|
+| 5b 20 24 ca 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |[ $.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 34 1f ec c4 43 2d ed c1 21 08 69 85 98 67 b9 ce |4...C-..!.i..g..|
+| 5b 20 24 ca |[ $. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #249 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 96 bd 0b b3 e1 58 b5 37 39 bc ae d4 57 0c 58 cf |.....X.79...W.X.|
+| 71 6c 96 7d a3 2b fe 0b 63 1a 8a a0 e2 61 8b b4 |ql.}.+..c....a..|
+| 39 6d 77 71 8c 79 d1 24 1d 2b d4 0e bf 64 de d4 |9mwq.y.$.+...d..|
+| 04 af f5 d6 26 7a 1c ad bb 47 2b 6d a5 44 6e 62 |....&z...G+m.Dnb|
+Plaintext[64]:
+| 3f 16 43 c8 78 70 e3 98 69 a3 a0 bd 22 42 73 43 |?.C.xp..i..."BsC|
+| 14 00 00 0c 19 c9 85 4a f2 f0 37 57 af f1 ef 1e |.......J..7W....|
+| 59 60 4c b7 51 89 3c 0b 8a 48 d6 f1 50 8f f6 a3 |Y`L.Q.<..H..P...|
+| 71 eb 2f 6e 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |q./n............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 59 60 4c b7 51 89 3c 0b 8a 48 d6 f1 50 8f f6 a3 |Y`L.Q.<..H..P...|
+| 71 eb 2f 6e |q./n |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #250 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 48 0e cc b0 d1 df 8a fe ac 57 f8 c0 0f 12 03 43 |H........W.....C|
+| 22 c9 42 a8 d6 ab c9 57 7c bb 50 18 3a 9e 74 71 |".B....W|.P.:.tq|
+| 22 f3 5a a5 4c f8 b3 15 0d 02 fa 25 0b 1e 09 e3 |".Z.L......%....|
+| 02 7e d1 4d 40 98 54 8a 73 d8 a4 85 d6 56 d4 50 |.~.M@.T.s....V.P|
+| cf 47 48 c2 11 5f 48 52 70 26 0a e5 e2 85 c5 c8 |.GH.._HRp&......|
+| ba 05 2f 49 91 d1 fa 69 25 04 9a 95 f4 4e e1 84 |../I...i%....N..|
+| 7e cb 4c 5c 05 2b ac 7f 00 48 8b e5 6e df 08 64 |~.L\.+...H..n..d|
+| 36 0d d9 a6 88 41 bd 93 ca 4a e3 99 1f 36 32 5e |6....A...J...62^|
+Plaintext[128]:
+| 5e 3b e9 1d 88 7d e4 89 2e 21 ce 05 ff 14 4b fd |^;...}...!....K.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a c4 06 71 |n.nl:4458......q|
+| b1 f1 b4 c9 f5 08 d1 54 fb 5c fa a1 d1 91 d4 05 |.......T.\......|
+| 7d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |}...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 27 6d d3 9c 0b 26 10 b1 77 77 a9 66 9e 9b 04 31 |'m...&..ww.f...1|
+| cc b8 e6 e3 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44831 found (nil)
+association_find: TCP port 4458 found 0x362fa20
+
+dissect_ssl enter frame #251 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 86 d2 0b e0 3d e7 99 7a bc 93 71 f7 5c 83 15 11 |....=..z..q.\...|
+| 7e fd d9 79 5c ca 16 a0 07 1e 77 eb b5 ec ab 1b |~..y\.....w.....|
+| 0b 3a 90 16 3b 79 98 14 d4 c8 68 9b 90 b6 c4 e3 |.:..;y....h.....|
+| 82 a5 f5 3a 7d f8 d3 75 4a 50 02 71 f0 98 47 93 |...:}..uJP.q..G.|
+| b3 12 c1 7f 03 c7 47 eb 19 f7 84 09 bb 34 24 0e |......G......4$.|
+| c8 d4 f3 5d f6 f5 9c 9c 9e 80 b3 f4 c5 e6 5c 06 |...]..........\.|
+| a1 7a 9d 88 5f f1 b1 9c 99 32 af 3a 10 d1 56 73 |.z.._....2.:..Vs|
+| 61 7b 81 c7 db d1 29 00 d0 c3 e6 1e bf f8 90 14 |a{....).........|
+| 5a 91 06 cf a9 ac 0c 09 71 0b 30 2e 8a dc fb 26 |Z.......q.0....&|
+| 4f 15 46 67 b8 3a d7 35 3b c1 e5 b1 69 ee 97 b3 |O.Fg.:.5;...i...|
+| ab a1 75 35 e1 cd db de 77 8e a0 fa 50 c7 db 49 |..u5....w...P..I|
+| 65 63 55 d2 ba 63 7a e1 7b 0f 08 0e 36 e3 5c 70 |ecU..cz.{...6.\p|
+| f3 96 ac ad bf c6 20 0b 50 7e 62 b7 32 4a 7e 48 |...... .P~b.2J~H|
+| 2c 75 04 9d ce 24 ce 89 cc 40 df 07 56 f3 29 f7 |,u...$...@..V.).|
+| fe 55 c8 02 2b a5 29 33 ca d1 b9 5d 88 41 41 f8 |.U..+.)3...].AA.|
+| c0 ee 24 ee 8a de 61 81 a9 f4 da a1 72 7d 9a 64 |..$...a.....r}.d|
+| 11 07 16 df 18 3b fa e8 5a 82 24 03 d6 fa 43 17 |.....;..Z.$...C.|
+| fe 57 6a 65 b4 f8 86 de ed d1 85 74 15 99 65 bf |.Wje.......t..e.|
+| ad e4 c2 96 10 68 c8 0d ed 9a 05 09 87 4a 18 7d |.....h.......J.}|
+| 76 44 5b 31 b4 8d f0 1e 09 5b 3b ce e8 f1 71 03 |vD[1.....[;...q.|
+| d5 bc 3e 04 e1 f2 d6 af ab 0b d5 b3 27 ab 48 db |..>.........'.H.|
+| 7d 96 57 99 c9 8d 49 e9 78 bb a4 38 ae 91 98 9d |}.W...I.x..8....|
+| cc a5 86 0a 87 b0 66 d9 44 62 e8 51 ed 94 56 d8 |......f.Db.Q..V.|
+| d2 10 7d 50 e8 26 9f 3a c3 d8 f3 02 fc 94 14 ee |..}P.&.:........|
+| 26 b5 2a 74 64 a8 0b 0c 13 be 80 53 c8 fc ef c4 |&.*td......S....|
+Plaintext[400]:
+| 5d c6 b4 1d 6e 5d 83 ee cf 69 dc 3c 02 ae 36 c6 |]...n]...i.<..6.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| a2 ef cc 42 a1 f6 43 09 3c f4 c8 dd 4b 5e 69 fa |...B..C.<...K^i.|
+| 73 82 c6 7c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |s..|............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 9e 08 3f f0 b2 ea 60 4c 4c 70 a6 07 43 f6 ba |...?...`LLp..C..|
+| f2 c6 a9 be |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4458 found 0x362fa20
+
+dissect_ssl enter frame #252 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 85 61 af 2e 35 b0 66 ed 75 41 12 69 36 11 37 53 |.a..5.f.uA.i6.7S|
+| d2 77 62 4c e7 4d a3 e6 88 57 5c 2b e1 4f 7b 21 |.wbL.M...W\+.O{!|
+| 37 b2 dd 00 f3 f6 c6 27 c0 50 d1 6d 72 50 c2 c3 |7......'.P.mrP..|
+Plaintext[48]:
+| 28 b7 c2 cd da 2c 4b 1d 44 d5 3f e8 77 cb 2f f8 |(....,K.D.?.w./.|
+| 01 00 2d 42 b8 bd 1d ba 6e c5 d3 7f bf 06 b9 50 |..-B....n......P|
+| 33 ed 25 ab 90 63 09 09 09 09 09 09 09 09 09 09 |3.%..c..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2d 42 b8 bd 1d ba 6e c5 d3 7f bf 06 b9 50 33 ed |-B....n......P3.|
+| 25 ab 90 63 |%..c |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #254 (first time)
+ conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 86 a6 03 cb ed 97 4c 24 f5 bb cc 86 36 09 ed 9d |......L$....6...|
+| 79 30 61 51 30 a7 da 2a 01 4a 90 1b f7 89 34 c0 |y0aQ0..*.J....4.|
+| 5d 47 1a 92 a8 12 f6 d7 ba 1b 3d 78 6c 01 ee f9 |]G........=xl...|
+Plaintext[48]:
+| 7b 64 d5 e7 67 61 0d 46 4d aa 72 7b 5c 93 6a a7 |{d..ga.FM.r{\.j.|
+| 01 00 47 6d ec b5 f4 31 c1 42 b5 44 47 bf 07 68 |..Gm...1.B.DG..h|
+| 0d fb ff 39 ad 76 09 09 09 09 09 09 09 09 09 09 |...9.v..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 47 6d ec b5 f4 31 c1 42 b5 44 47 bf 07 68 0d fb |Gm...1.B.DG..h..|
+| ff 39 ad 76 |.9.v |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #259 (first time)
+ssl_session_init: initializing ptr 0x7fca45bee3e0 size 688
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45712 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4459
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #261 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bf b3 a6 e2 2a 71 ee 4a 90 54 a4 55 87 d9 a1 f9 |....*q.J.T.U....|
+| 9b 7c 7c 10 7b f0 49 1e 55 1c 67 6d c3 d4 6b a1 |.||.{.I.U.gm..k.|
+| ac 86 b4 de 39 47 58 4c ad 09 d1 5f b2 4f bb 91 |....9GXL..._.O..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 85 16 cd f3 be 95 44 a5 55 9d 3e fa dd 76 0a |.......D.U.>..v.|
+| d8 8a de 23 61 a1 fb cb 35 45 4e af 70 52 34 c2 |...#a...5EN.pR4.|
+| f1 63 7d e3 79 73 f0 f7 cb 4c 9c a2 ee bc 55 9c |.c}.ys...L....U.|
+| b6 27 17 60 79 f2 72 62 6f 72 fc 48 ab |.'.`y.rbor.H. |
+hash out[104]:
+| 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...|
+| 2c 5a e8 b7 b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 |,Z..../.....h.E.|
+| f8 6b b2 2a c8 e2 52 8d dd de d8 85 a0 df d3 df |.k.*..R.........|
+| 53 96 ed 86 7d ec 51 eb d5 1f 47 2b 80 e8 d9 84 |S...}.Q...G+....|
+| 91 ed f4 71 27 3d 1e e3 43 06 1a 32 a6 4e 29 9c |...q'=..C..2.N).|
+| c8 fd 46 12 60 96 68 fc 84 5a 59 d1 cd 62 92 a4 |..F.`.h..ZY..b..|
+| a1 0d d6 b3 3b bf b2 4f |....;..O |
+PRF out[104]:
+| 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...|
+| 2c 5a e8 b7 b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 |,Z..../.....h.E.|
+| f8 6b b2 2a c8 e2 52 8d dd de d8 85 a0 df d3 df |.k.*..R.........|
+| 53 96 ed 86 7d ec 51 eb d5 1f 47 2b 80 e8 d9 84 |S...}.Q...G+....|
+| 91 ed f4 71 27 3d 1e e3 43 06 1a 32 a6 4e 29 9c |...q'=..C..2.N).|
+| c8 fd 46 12 60 96 68 fc 84 5a 59 d1 cd 62 92 a4 |..F.`.h..ZY..b..|
+| a1 0d d6 b3 3b bf b2 4f |....;..O |
+key expansion[104]:
+| 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...|
+| 2c 5a e8 b7 b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 |,Z..../.....h.E.|
+| f8 6b b2 2a c8 e2 52 8d dd de d8 85 a0 df d3 df |.k.*..R.........|
+| 53 96 ed 86 7d ec 51 eb d5 1f 47 2b 80 e8 d9 84 |S...}.Q...G+....|
+| 91 ed f4 71 27 3d 1e e3 43 06 1a 32 a6 4e 29 9c |...q'=..C..2.N).|
+| c8 fd 46 12 60 96 68 fc 84 5a 59 d1 cd 62 92 a4 |..F.`.h..ZY..b..|
+| a1 0d d6 b3 3b bf b2 4f |....;..O |
+Client MAC key[20]:
+| 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...|
+| 2c 5a e8 b7 |,Z.. |
+Server MAC key[20]:
+| b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 f8 6b b2 2a |../.....h.E..k.*|
+| c8 e2 52 8d |..R. |
+Client Write key[16]:
+| dd de d8 85 a0 df d3 df 53 96 ed 86 7d ec 51 eb |........S...}.Q.|
+Server Write key[16]:
+| d5 1f 47 2b 80 e8 d9 84 91 ed f4 71 27 3d 1e e3 |..G+.......q'=..|
+Client Write IV[16]:
+| 43 06 1a 32 a6 4e 29 9c c8 fd 46 12 60 96 68 fc |C..2.N)...F.`.h.|
+Server Write IV[16]:
+| 84 5a 59 d1 cd 62 92 a4 a1 0d d6 b3 3b bf b2 4f |.ZY..b......;..O|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #263 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079...
+looking for RSA pre-master008026623446ce90bc7960ea641d4009a018c4c1f458d7b3...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e0 ac 82 c7 35 69 c5 18 cd 00 8c 8c 27 47 dd da |....5i......'G..|
+| 2d c7 f7 b0 31 b7 41 b0 c1 96 34 f2 75 1d e5 7c |-...1.A...4.u..||
+| 06 4b a8 c3 22 ed 95 be 54 19 6a 47 cc d9 89 7b |.K.."...T.jG...{|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 85 16 cd f3 be 95 44 a5 55 9d 3e fa dd 76 0a |.......D.U.>..v.|
+| d8 8a de 23 61 a1 fb cb 35 45 4e af 70 52 34 c2 |...#a...5EN.pR4.|
+| f1 63 7d e3 79 73 f0 f7 cb 4c 9c a2 ee bc 55 9c |.c}.ys...L....U.|
+| b6 27 17 60 79 f2 72 62 6f 72 fc 48 ab |.'.`y.rbor.H. |
+hash out[104]:
+| 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....|
+| b6 52 a6 6e b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 |.R.n..J..6.>..AD|
+| 04 a3 6e 51 74 5d 21 a4 8e 6a 1a f8 35 00 94 e9 |..nQt]!..j..5...|
+| 0c 6b d3 f5 b3 98 75 65 a3 19 d3 d3 75 88 65 d8 |.k....ue....u.e.|
+| e2 b5 c7 d5 d3 7e 9c 7d e4 73 98 6f 03 11 c2 e8 |.....~.}.s.o....|
+| e0 9a 3b e3 3a 28 06 f7 dc 0d bc 03 9d d7 a7 6d |..;.:(.........m|
+| 02 37 aa 70 45 ca 5c 18 |.7.pE.\. |
+PRF out[104]:
+| 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....|
+| b6 52 a6 6e b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 |.R.n..J..6.>..AD|
+| 04 a3 6e 51 74 5d 21 a4 8e 6a 1a f8 35 00 94 e9 |..nQt]!..j..5...|
+| 0c 6b d3 f5 b3 98 75 65 a3 19 d3 d3 75 88 65 d8 |.k....ue....u.e.|
+| e2 b5 c7 d5 d3 7e 9c 7d e4 73 98 6f 03 11 c2 e8 |.....~.}.s.o....|
+| e0 9a 3b e3 3a 28 06 f7 dc 0d bc 03 9d d7 a7 6d |..;.:(.........m|
+| 02 37 aa 70 45 ca 5c 18 |.7.pE.\. |
+key expansion[104]:
+| 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....|
+| b6 52 a6 6e b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 |.R.n..J..6.>..AD|
+| 04 a3 6e 51 74 5d 21 a4 8e 6a 1a f8 35 00 94 e9 |..nQt]!..j..5...|
+| 0c 6b d3 f5 b3 98 75 65 a3 19 d3 d3 75 88 65 d8 |.k....ue....u.e.|
+| e2 b5 c7 d5 d3 7e 9c 7d e4 73 98 6f 03 11 c2 e8 |.....~.}.s.o....|
+| e0 9a 3b e3 3a 28 06 f7 dc 0d bc 03 9d d7 a7 6d |..;.:(.........m|
+| 02 37 aa 70 45 ca 5c 18 |.7.pE.\. |
+Client MAC key[20]:
+| 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....|
+| b6 52 a6 6e |.R.n |
+Server MAC key[20]:
+| b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 04 a3 6e 51 |..J..6.>..AD..nQ|
+| 74 5d 21 a4 |t]!. |
+Client Write key[16]:
+| 8e 6a 1a f8 35 00 94 e9 0c 6b d3 f5 b3 98 75 65 |.j..5....k....ue|
+Server Write key[16]:
+| a3 19 d3 d3 75 88 65 d8 e2 b5 c7 d5 d3 7e 9c 7d |....u.e......~.}|
+Client Write IV[16]:
+| e4 73 98 6f 03 11 c2 e8 e0 9a 3b e3 3a 28 06 f7 |.s.o......;.:(..|
+Server Write IV[16]:
+| dc 0d bc 03 9d d7 a7 6d 02 37 aa 70 45 ca 5c 18 |.......m.7.pE.\.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| e0 ac 82 c7 35 69 c5 18 cd 00 8c 8c 27 47 dd da |....5i......'G..|
+| 2d c7 f7 b0 31 b7 41 b0 c1 96 34 f2 75 1d e5 7c |-...1.A...4.u..||
+| 06 4b a8 c3 22 ed 95 be 54 19 6a 47 cc d9 89 7b |.K.."...T.jG...{|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b4 3f c3 25 7f 4e 49 55 76 e2 30 ac 75 64 31 6a |.?.%.NIUv.0.ud1j|
+| 61 27 98 d3 57 93 f2 76 a3 03 00 bf 58 a3 b3 e9 |a'..W..v....X...|
+| 82 73 01 61 9e 53 88 cd 3f f3 eb df 8e 6b d3 19 |.s.a.S..?....k..|
+| 6b e2 9a 85 a8 ac d1 85 f7 0e 8d 36 36 1f 7b f2 |k..........66.{.|
+Plaintext[64]:
+| 6d 60 32 fe fc 34 c2 30 06 2a af 14 ee 83 7f 9b |m`2..4.0.*......|
+| 14 00 00 0c 59 81 33 28 63 4c 25 de 29 5c 98 65 |....Y.3(cL%.)\.e|
+| f1 83 ce 4d ad 6b e1 7c 31 0f ec 2d 62 b9 a8 67 |...M.k.|1..-b..g|
+| 68 aa d8 c3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |h...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f1 83 ce 4d ad 6b e1 7c 31 0f ec 2d 62 b9 a8 67 |...M.k.|1..-b..g|
+| 68 aa d8 c3 |h... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #264 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| aa 8a 46 75 bb 2d 08 c2 9e 86 47 1e 5d b5 55 2b |..Fu.-....G.].U+|
+| 63 d8 c0 37 64 76 31 eb 78 07 fb 40 f1 a0 8b 70 |c..7dv1.x..@...p|
+| 89 db 48 e7 d0 47 ee e5 a7 0e 3a c7 91 51 94 74 |..H..G....:..Q.t|
+| a1 43 c7 5f 52 d3 d1 de 99 60 54 92 74 82 ca 5e |.C._R....`T.t..^|
+Plaintext[64]:
+| db e7 58 bf eb 38 bf c3 c4 08 9c 5b ae f2 20 2b |..X..8.....[.. +|
+| 14 00 00 0c 91 26 db ed cb de 01 b6 d3 8a f9 a2 |.....&..........|
+| 21 9f 0e d7 22 eb 2a 99 f0 ea d2 45 84 aa 99 20 |!...".*....E... |
+| 9e a3 10 d7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 21 9f 0e d7 22 eb 2a 99 f0 ea d2 45 84 aa 99 20 |!...".*....E... |
+| 9e a3 10 d7 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #265 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| f9 9e ac 46 9e f6 d8 55 4f 59 58 0c ac 46 d9 1e |...F...UOYX..F..|
+| 1a f2 34 a9 27 df fe 4d e3 0b f6 89 93 40 db 07 |..4.'..M.....@..|
+| e3 03 90 0c ec a8 31 05 9f ad b9 b5 f0 63 99 bf |......1......c..|
+| d5 01 51 1b aa 5c 0f 56 9e b8 0e 14 5c 6b e3 99 |..Q..\.V....\k..|
+| cd 0a e6 02 d7 d4 da 5c 4e b9 ad 92 af a7 4b a0 |.......\N.....K.|
+| ca de 98 98 e5 a0 42 f4 6e 66 c2 a4 eb af 84 bb |......B.nf......|
+| 49 97 ac 85 6f ef 28 ea c1 65 aa c5 62 f4 da 7c |I...o.(..e..b..||
+| 25 d0 57 8a 1b 13 7a 4e 3d 52 65 bc fb a1 4f 2b |%.W...zN=Re...O+|
+Plaintext[128]:
+| 7b ef cb a1 a5 fb ad 04 9c 17 99 30 7d c5 eb 3f |{..........0}..?|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a 54 bd f4 |n.nl:4459....T..|
+| 97 57 83 e7 b3 aa 68 3f 83 e2 aa d3 f3 31 3e 56 |.W....h?.....1>V|
+| 8d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1c e7 01 99 53 17 71 36 cc 95 e9 49 fd 8e ae 14 |....S.q6...I....|
+| 7b 4d 05 75 |{M.u |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45712 found (nil)
+association_find: TCP port 4459 found 0x362fab0
+
+dissect_ssl enter frame #266 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d8 e9 22 02 b1 ba 1f 41 10 1f f5 17 7a b7 33 5c |.."....A....z.3\|
+| 09 34 11 5e bc 53 1a a9 78 24 59 79 7b 2a cd c7 |.4.^.S..x$Yy{*..|
+| 9f d4 4d 8d 0d 1f f3 e3 de 53 92 55 de d8 b7 fd |..M......S.U....|
+| b6 5c d2 14 d6 13 1a cb 77 6f 27 0a 3a 41 5f 57 |.\......wo'.:A_W|
+| 7a 5c 2d 98 3b 2e 3c 48 37 c5 ed ca be 50 b0 f8 |z\-.;.<H7....P..|
+| e6 33 83 f8 41 91 33 f9 93 0f 18 35 30 75 dd 4d |.3..A.3....50u.M|
+| b8 4b 29 de e1 1d 34 21 8a fd ea d1 90 79 b2 50 |.K)...4!.....y.P|
+| e2 10 79 15 f0 57 3c 27 78 1b 30 3e c6 4d 78 fd |..y..W<'x.0>.Mx.|
+| 1a 9f 32 6e 70 a9 e2 d1 81 ae 53 8f f2 43 df 00 |..2np.....S..C..|
+| 65 65 ea e0 b6 77 87 2b 1f b3 69 ac f0 c4 06 f2 |ee...w.+..i.....|
+| d3 33 b3 09 b6 c1 fa 3d 98 b6 ba 12 64 b5 61 81 |.3.....=....d.a.|
+| b2 f6 eb 22 04 b4 2e 2e 90 57 3a 4a 9c 77 6c 4b |...".....W:J.wlK|
+| b9 63 05 aa 6c a0 5a 47 10 b6 5d f1 ff 49 a8 6e |.c..l.ZG..]..I.n|
+| 30 b3 53 07 96 40 14 ad 0e 29 d5 d7 a9 81 ce 3f |0.S..@...).....?|
+| b9 ff 03 53 62 db dd f0 2f de 2a e1 14 b2 70 9e |...Sb.../.*...p.|
+| fb 4c 63 8b fb 7f 85 22 92 3d e2 cc a8 de bd 9a |.Lc....".=......|
+| 56 ab f9 f0 db 95 35 21 82 ec 30 9c f8 38 81 fc |V.....5!..0..8..|
+| 08 41 c8 f2 e3 a8 0e a5 e4 d2 1e dc e8 4f 37 b1 |.A...........O7.|
+| 37 d2 d5 1f 41 e9 a7 4f 5e 7b b2 dc cc 53 cd 7e |7...A..O^{...S.~|
+| 75 18 80 0c d2 93 9e 20 90 1a 8b 4b 57 24 24 fb |u...... ...KW$$.|
+| be 58 b6 9f e4 2f 0a db c1 19 42 b6 d6 16 36 08 |.X.../....B...6.|
+| 0b 25 d1 30 13 86 6d 1f 86 26 fd 65 f1 f0 b9 9b |.%.0..m..&.e....|
+| 78 72 48 88 dd 60 91 4c 14 33 e0 98 17 2a fe 79 |xrH..`.L.3...*.y|
+| 3a 9c 2b ef 7b 7f 42 7f b2 76 5c f7 59 e4 18 fc |:.+.{.B..v\.Y...|
+| e0 16 d6 26 0e 44 ca 46 4d 1f 72 20 3b c4 61 4f |...&.D.FM.r ;.aO|
+Plaintext[400]:
+| 47 ff 55 29 c7 65 f9 25 27 e9 77 22 01 9d 13 0a |G.U).e.%'.w"....|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 3a 19 6a 82 a3 80 c0 3b 65 3c fb bb dc 0c d2 8b |:.j....;e<......|
+| fb 0b 0d 1d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e5 29 3d f8 74 22 96 1d 9e 02 fe a8 e0 d8 22 e1 |.)=.t"........".|
+| db 9f ef 01 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4459 found 0x362fab0
+
+dissect_ssl enter frame #267 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 5e 19 19 6d c8 ce bf db 7d 42 06 04 f6 a0 86 c6 |^..m....}B......|
+| c4 b5 6b af 34 17 aa 8c 48 76 2b ea b9 a6 a9 10 |..k.4...Hv+.....|
+| 1d ff 0b 2e 14 c0 2f 92 ff b1 ef 73 e7 f0 ff e4 |....../....s....|
+Plaintext[48]:
+| 96 26 11 11 d3 83 b1 be d6 af 09 a1 42 f0 7b d7 |.&..........B.{.|
+| 01 00 f8 c5 b1 76 ed cb 2f c1 0e 36 01 00 d8 2e |.....v../..6....|
+| 79 94 62 2f e5 2c 09 09 09 09 09 09 09 09 09 09 |y.b/.,..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f8 c5 b1 76 ed cb 2f c1 0e 36 01 00 d8 2e 79 94 |...v../..6....y.|
+| 62 2f e5 2c |b/., |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #269 (first time)
+ conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 0d 63 7a 9b 73 b3 3f 2f 3d a4 74 4c a0 de 84 e8 |.cz.s.?/=.tL....|
+| b2 3b e8 69 89 bc 6a 9a 34 11 0d 3d 98 19 e4 95 |.;.i..j.4..=....|
+| 3c c5 95 c4 96 4f 4e 66 f4 87 13 aa bb 35 7b 68 |<....ONf.....5{h|
+Plaintext[48]:
+| 24 67 80 63 95 68 97 66 18 96 3c 42 bc e8 9f 93 |$g.c.h.f..<B....|
+| 01 00 10 60 48 d2 eb e1 ef 28 6b 03 4d d0 8b c0 |...`H....(k.M...|
+| df d5 f4 ef 35 ee 09 09 09 09 09 09 09 09 09 09 |....5...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 10 60 48 d2 eb e1 ef 28 6b 03 4d d0 8b c0 df d5 |.`H....(k.M.....|
+| f4 ef 35 ee |..5. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #274 (first time)
+ssl_session_init: initializing ptr 0x7fca45bf0920 size 688
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46045 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4463
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #276 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e0 ac 82 c7 35 69 c5 18 cd 00 8c 8c 27 47 dd da |....5i......'G..|
+| 2d c7 f7 b0 31 b7 41 b0 c1 96 34 f2 75 1d e5 7c |-...1.A...4.u..||
+| 06 4b a8 c3 22 ed 95 be 54 19 6a 47 cc d9 89 7b |.K.."...T.jG...{|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 84 ee f3 da c8 b4 22 c8 9d a5 e0 ea fb b7 46 |.......".......F|
+| d0 11 12 66 ec cf 45 34 48 89 51 8b ec 52 34 c2 |...f..E4H.Q..R4.|
+| f1 0f 5a c6 3a 3a 3a b8 77 01 37 24 4c 56 27 b3 |..Z.:::.w.7$LV'.|
+| 34 6a 4f 34 a2 e7 b5 36 5a da 9a b8 c0 |4jO4...6Z.... |
+hash out[136]:
+| b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......|
+| 3c 2e d1 11 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 |<.....&..)',G.l#|
+| 25 7f e7 f7 1c 44 2b b2 67 5c 27 91 af 19 b9 16 |%....D+.g\'.....|
+| d0 10 5e 1b f2 cb 1e 95 90 90 6d b2 ca 74 73 97 |..^.......m..ts.|
+| d5 93 ed 4a 2c b7 df 28 42 4c 82 c4 a1 11 35 11 |...J,..(BL....5.|
+| dc c8 86 71 a7 63 03 2a 16 c1 50 f6 9c b0 03 bf |...q.c.*..P.....|
+| 02 2e 41 08 d8 51 f0 9b d6 81 ce 54 7f 26 48 18 |..A..Q.....T.&H.|
+| dc 4b a3 95 91 6f f4 e0 f4 3d 6d 27 a5 ec 51 40 |.K...o...=m'..Q@|
+| 42 f6 99 c9 a9 28 c2 7c |B....(.| |
+PRF out[136]:
+| b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......|
+| 3c 2e d1 11 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 |<.....&..)',G.l#|
+| 25 7f e7 f7 1c 44 2b b2 67 5c 27 91 af 19 b9 16 |%....D+.g\'.....|
+| d0 10 5e 1b f2 cb 1e 95 90 90 6d b2 ca 74 73 97 |..^.......m..ts.|
+| d5 93 ed 4a 2c b7 df 28 42 4c 82 c4 a1 11 35 11 |...J,..(BL....5.|
+| dc c8 86 71 a7 63 03 2a 16 c1 50 f6 9c b0 03 bf |...q.c.*..P.....|
+| 02 2e 41 08 d8 51 f0 9b d6 81 ce 54 7f 26 48 18 |..A..Q.....T.&H.|
+| dc 4b a3 95 91 6f f4 e0 f4 3d 6d 27 a5 ec 51 40 |.K...o...=m'..Q@|
+| 42 f6 99 c9 a9 28 c2 7c |B....(.| |
+key expansion[136]:
+| b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......|
+| 3c 2e d1 11 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 |<.....&..)',G.l#|
+| 25 7f e7 f7 1c 44 2b b2 67 5c 27 91 af 19 b9 16 |%....D+.g\'.....|
+| d0 10 5e 1b f2 cb 1e 95 90 90 6d b2 ca 74 73 97 |..^.......m..ts.|
+| d5 93 ed 4a 2c b7 df 28 42 4c 82 c4 a1 11 35 11 |...J,..(BL....5.|
+| dc c8 86 71 a7 63 03 2a 16 c1 50 f6 9c b0 03 bf |...q.c.*..P.....|
+| 02 2e 41 08 d8 51 f0 9b d6 81 ce 54 7f 26 48 18 |..A..Q.....T.&H.|
+| dc 4b a3 95 91 6f f4 e0 f4 3d 6d 27 a5 ec 51 40 |.K...o...=m'..Q@|
+| 42 f6 99 c9 a9 28 c2 7c |B....(.| |
+Client MAC key[20]:
+| b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......|
+| 3c 2e d1 11 |<... |
+Server MAC key[20]:
+| 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 25 7f e7 f7 |..&..)',G.l#%...|
+| 1c 44 2b b2 |.D+. |
+Client Write key[32]:
+| 67 5c 27 91 af 19 b9 16 d0 10 5e 1b f2 cb 1e 95 |g\'.......^.....|
+| 90 90 6d b2 ca 74 73 97 d5 93 ed 4a 2c b7 df 28 |..m..ts....J,..(|
+Server Write key[32]:
+| 42 4c 82 c4 a1 11 35 11 dc c8 86 71 a7 63 03 2a |BL....5....q.c.*|
+| 16 c1 50 f6 9c b0 03 bf 02 2e 41 08 d8 51 f0 9b |..P.......A..Q..|
+Client Write IV[16]:
+| d6 81 ce 54 7f 26 48 18 dc 4b a3 95 91 6f f4 e0 |...T.&H..K...o..|
+Server Write IV[16]:
+| f4 3d 6d 27 a5 ec 51 40 42 f6 99 c9 a9 28 c2 7c |.=m'..Q@B....(.||
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #278 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2...
+looking for RSA pre-masterb2e73e29db1e25760dde23be4a9ca0f8d0fdd0c2ddce5aff...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 33 e5 c3 73 96 41 ea 8b 00 3e 5c 42 69 95 5f c9 |3..s.A...>\Bi._.|
+| b5 70 41 12 23 32 36 1b 15 12 46 11 c4 3b c3 8d |.pA.#26...F..;..|
+| 98 db 5b fd e3 75 23 ec 09 55 de 3c 3c 8c d0 11 |..[..u#..U.<<...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f1 84 ee f3 da c8 b4 22 c8 9d a5 e0 ea fb b7 46 |.......".......F|
+| d0 11 12 66 ec cf 45 34 48 89 51 8b ec 52 34 c2 |...f..E4H.Q..R4.|
+| f1 0f 5a c6 3a 3a 3a b8 77 01 37 24 4c 56 27 b3 |..Z.:::.w.7$LV'.|
+| 34 6a 4f 34 a2 e7 b5 36 5a da 9a b8 c0 |4jO4...6Z.... |
+hash out[136]:
+| b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.|
+| 9d f9 86 93 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 |....C.Jk.{.c...r|
+| 74 47 6a 25 ba 76 13 c9 59 c9 cf 69 d3 a7 74 0e |tGj%.v..Y..i..t.|
+| f6 52 87 2c 33 47 7a af b1 fd d6 78 c7 c2 fb de |.R.,3Gz....x....|
+| a2 6f 0c cc 17 92 2f 61 83 68 3d 7f c3 57 3d ad |.o..../a.h=..W=.|
+| a8 4f d1 a0 64 5d 87 b7 81 66 12 73 a1 7b 9a f0 |.O..d]...f.s.{..|
+| 18 98 65 f4 8e be 51 b7 fe 32 ce 4b 17 96 88 da |..e...Q..2.K....|
+| fa 0d 1a 65 b7 bd 22 d8 b0 c7 4c 0b 67 06 2c 36 |...e.."...L.g.,6|
+| 11 48 85 e8 38 75 e8 03 |.H..8u.. |
+PRF out[136]:
+| b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.|
+| 9d f9 86 93 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 |....C.Jk.{.c...r|
+| 74 47 6a 25 ba 76 13 c9 59 c9 cf 69 d3 a7 74 0e |tGj%.v..Y..i..t.|
+| f6 52 87 2c 33 47 7a af b1 fd d6 78 c7 c2 fb de |.R.,3Gz....x....|
+| a2 6f 0c cc 17 92 2f 61 83 68 3d 7f c3 57 3d ad |.o..../a.h=..W=.|
+| a8 4f d1 a0 64 5d 87 b7 81 66 12 73 a1 7b 9a f0 |.O..d]...f.s.{..|
+| 18 98 65 f4 8e be 51 b7 fe 32 ce 4b 17 96 88 da |..e...Q..2.K....|
+| fa 0d 1a 65 b7 bd 22 d8 b0 c7 4c 0b 67 06 2c 36 |...e.."...L.g.,6|
+| 11 48 85 e8 38 75 e8 03 |.H..8u.. |
+key expansion[136]:
+| b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.|
+| 9d f9 86 93 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 |....C.Jk.{.c...r|
+| 74 47 6a 25 ba 76 13 c9 59 c9 cf 69 d3 a7 74 0e |tGj%.v..Y..i..t.|
+| f6 52 87 2c 33 47 7a af b1 fd d6 78 c7 c2 fb de |.R.,3Gz....x....|
+| a2 6f 0c cc 17 92 2f 61 83 68 3d 7f c3 57 3d ad |.o..../a.h=..W=.|
+| a8 4f d1 a0 64 5d 87 b7 81 66 12 73 a1 7b 9a f0 |.O..d]...f.s.{..|
+| 18 98 65 f4 8e be 51 b7 fe 32 ce 4b 17 96 88 da |..e...Q..2.K....|
+| fa 0d 1a 65 b7 bd 22 d8 b0 c7 4c 0b 67 06 2c 36 |...e.."...L.g.,6|
+| 11 48 85 e8 38 75 e8 03 |.H..8u.. |
+Client MAC key[20]:
+| b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.|
+| 9d f9 86 93 |.... |
+Server MAC key[20]:
+| 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 74 47 6a 25 |C.Jk.{.c...rtGj%|
+| ba 76 13 c9 |.v.. |
+Client Write key[32]:
+| 59 c9 cf 69 d3 a7 74 0e f6 52 87 2c 33 47 7a af |Y..i..t..R.,3Gz.|
+| b1 fd d6 78 c7 c2 fb de a2 6f 0c cc 17 92 2f 61 |...x.....o..../a|
+Server Write key[32]:
+| 83 68 3d 7f c3 57 3d ad a8 4f d1 a0 64 5d 87 b7 |.h=..W=..O..d]..|
+| 81 66 12 73 a1 7b 9a f0 18 98 65 f4 8e be 51 b7 |.f.s.{....e...Q.|
+Client Write IV[16]:
+| fe 32 ce 4b 17 96 88 da fa 0d 1a 65 b7 bd 22 d8 |.2.K.......e..".|
+Server Write IV[16]:
+| b0 c7 4c 0b 67 06 2c 36 11 48 85 e8 38 75 e8 03 |..L.g.,6.H..8u..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 33 e5 c3 73 96 41 ea 8b 00 3e 5c 42 69 95 5f c9 |3..s.A...>\Bi._.|
+| b5 70 41 12 23 32 36 1b 15 12 46 11 c4 3b c3 8d |.pA.#26...F..;..|
+| 98 db 5b fd e3 75 23 ec 09 55 de 3c 3c 8c d0 11 |..[..u#..U.<<...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| e2 78 48 13 68 2b ed 47 b2 fd 71 95 aa ea 49 ee |.xH.h+.G..q...I.|
+| c3 92 79 e2 8b d0 bb c6 2d 2d 0f 73 0d c1 18 b1 |..y.....--.s....|
+| 90 dd 47 fe ed 2a b1 ea 32 e8 07 88 b7 b2 54 c7 |..G..*..2.....T.|
+| 5e 88 ec fe 22 e7 a2 25 c7 e2 cd 59 13 fa b3 3c |^..."..%...Y...<|
+Plaintext[64]:
+| 55 f0 62 0a c6 7c 89 9d 05 ff 82 e2 15 46 63 ee |U.b..|.......Fc.|
+| 14 00 00 0c 3c cd 8e 07 86 ab 12 17 d1 83 b5 16 |....<...........|
+| 4d 5d 22 e4 f0 41 82 7e 30 10 7e 3d 59 42 66 30 |M]"..A.~0.~=YBf0|
+| a9 6a 7c 63 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.j|c............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4d 5d 22 e4 f0 41 82 7e 30 10 7e 3d 59 42 66 30 |M]"..A.~0.~=YBf0|
+| a9 6a 7c 63 |.j|c |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #279 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 20 4a a9 e5 2e e8 c0 7f d2 a8 26 b4 1e c7 4d a3 | J........&...M.|
+| 10 e2 e4 f4 32 ce 49 87 ef 66 fe 36 98 53 d6 da |....2.I..f.6.S..|
+| 03 d5 84 84 ae 55 3d d7 e7 bd d2 d2 85 2f 21 10 |.....U=....../!.|
+| 33 4f 8b ce dd 65 64 93 f8 df 3a 28 54 eb f6 27 |3O...ed...:(T..'|
+Plaintext[64]:
+| a2 59 23 34 12 8a 36 b0 81 6e 0f 67 e1 1c 3e 11 |.Y#4..6..n.g..>.|
+| 14 00 00 0c 9f 9b 48 4d ac 5a 28 c3 8b 03 16 8e |......HM.Z(.....|
+| b4 e7 98 05 00 71 2d 72 13 98 94 3b b4 f7 cc ca |.....q-r...;....|
+| 0f 65 91 e9 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.e..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 e7 98 05 00 71 2d 72 13 98 94 3b b4 f7 cc ca |.....q-r...;....|
+| 0f 65 91 e9 |.e.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #280 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 22 f3 a2 2c 25 fc 11 54 60 f0 b9 73 e2 22 6b 61 |"..,%..T`..s."ka|
+| 51 25 52 76 12 08 83 9b 15 24 e0 94 af 20 3c 67 |Q%Rv.....$... <g|
+| f6 72 f3 4f bb a5 33 c4 f9 0e a2 9b c9 a8 63 f1 |.r.O..3.......c.|
+| cb 1d 5e 21 bb 0a fd f7 d5 b6 67 dd 01 7d 26 23 |..^!......g..}&#|
+| e1 f6 aa ac 8a 22 cf aa 3f ad 47 20 6f cd b6 c3 |....."..?.G o...|
+| fa c2 01 3d 52 8b 4a 7b 47 06 be 6f 21 ba c4 5d |...=R.J{G..o!..]|
+| 6c c0 43 52 7b a6 92 5c cf 55 35 b4 27 dc a8 4b |l.CR{..\.U5.'..K|
+Plaintext[112]:
+| fb 4a 55 d8 30 4b 39 28 fd ab 00 75 c2 7a 40 d2 |.JU.0K9(...u.z@.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25|
+| 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446|
+| 33 0d 0a 0d 0a 05 0f fa 10 0c 88 fa e9 9d b1 e8 |3...............|
+| c8 b5 ef 74 0d fe af 65 24 06 06 06 06 06 06 06 |...t...e$.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a9 9c 4a 6f 7a 7d 45 9c 34 73 a3 2a 5e 98 a7 69 |..Joz}E.4s.*^..i|
+| be b8 eb 58 |...X |
+ssl_decrypt_record: mac failed
+association_find: TCP port 46045 found (nil)
+association_find: TCP port 4463 found 0x3630510
+
+dissect_ssl enter frame #281 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 70 7b 13 c2 1d 0a de 85 5b 73 cb e3 79 3d f8 a8 |p{......[s..y=..|
+| 02 c9 b9 b2 b2 7d 39 45 6c e2 f2 c9 9c 74 b2 f3 |.....}9El....t..|
+| d9 c9 52 d2 f6 46 ba ba 63 9e ef 1c 33 ba 74 ae |..R..F..c...3.t.|
+| 42 fb b0 00 4f f7 88 9e 2e 48 11 0b b8 f9 cb e3 |B...O....H......|
+| a9 9e 6e 93 9a ce f5 21 aa 6c 92 b9 8f 1c 2e 14 |..n....!.l......|
+| 05 3f 2f 96 fd 67 bf 07 71 ab 5d ba 5b cc a4 34 |.?/..g..q.].[..4|
+| 45 7c 15 24 23 4b 77 f1 c3 9b d6 ee 75 a1 5e d8 |E|.$#Kw.....u.^.|
+| 7e 8e 76 48 f4 b7 d3 f8 f6 a8 a8 29 bd db 2e a8 |~.vH.......)....|
+| 0a 86 ba e0 7a 32 58 f8 52 24 ec a0 43 2a 7c 6d |....z2X.R$..C*|m|
+| c4 76 24 26 0d a2 fe 63 87 b2 c9 e3 5e d8 40 f3 |.v$&...c....^.@.|
+| 7d be dd 69 1c 47 63 05 2f e8 60 a2 e8 0c 64 83 |}..i.Gc./.`...d.|
+| 5d c5 6f 18 c6 5f 03 6f bb ee 1a 91 2b f5 d1 cc |].o.._.o....+...|
+| 99 73 c3 32 46 91 21 99 2b 91 32 00 b9 ba ad a3 |.s.2F.!.+.2.....|
+| b8 55 b5 38 67 9e 15 f2 4f c9 ef cf 7b e1 12 f7 |.U.8g...O...{...|
+| 71 d4 c4 04 0f a2 79 09 dd b8 7f 7d 56 cd e6 97 |q.....y....}V...|
+| d0 9c f7 5c 99 cc ff d9 83 a5 29 ec 69 38 71 b8 |...\......).i8q.|
+| 87 2f ce e3 7c 42 1c db 92 c4 65 4c 54 4d 19 fe |./..|B....eLTM..|
+| bb c3 b0 84 b0 26 3c 27 30 c8 d3 3b 5e 52 8d 33 |.....&<'0..;^R.3|
+| 44 c8 45 1a a4 2d 80 0a ce 46 cf e6 40 da b6 d2 |D.E..-...F..@...|
+| b4 33 0a 13 68 ee 4f 3e 0a 34 f0 3a 7f 01 2e 35 |.3..h.O>.4.:...5|
+| 8b da e7 27 5e 0c d7 80 7a 07 b7 66 4e 7b 9d dc |...'^...z..fN{..|
+| 4f 01 fe c9 76 74 b3 dc 7c 2f ac 4d 3c ff cd d0 |O...vt..|/.M<...|
+| 54 d3 21 16 9f 24 50 8c a9 ca d8 b0 36 74 20 3b |T.!..$P.....6t ;|
+| 2a a3 01 1d 06 95 d1 12 62 c7 fc 9b 06 6b 9e d2 |*.......b....k..|
+| 04 3e 91 b8 a9 1b 6d d2 0b dd 4d c8 82 9d 27 bd |.>....m...M...'.|
+Plaintext[400]:
+| a6 23 8e 39 4b fb b1 13 4e 3a ab db c0 de 26 aa |.#.9K...N:....&.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL|
+| 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| df 29 e8 5b d5 ad c2 85 4d cb 79 c9 c9 f8 53 c0 |.).[....M.y...S.|
+| 85 6b 36 af 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.k6.............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 94 93 ca 0c 29 55 c7 c0 53 b7 0d f5 6c 30 93 f6 |....)U..S...l0..|
+| 94 75 b1 e8 |.u.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4463 found 0x3630510
+
+dissect_ssl enter frame #282 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 52 d9 7e 4c 37 b5 2b 9c 4a e7 c9 39 6c e5 05 27 |R.~L7.+.J..9l..'|
+| 62 ce e8 35 2f 4a 70 77 a5 c3 ec a2 21 53 50 0f |b..5/Jpw....!SP.|
+| 3f 46 30 b3 9c a4 1b 1e 4c 41 93 0a c2 b1 f5 f0 |?F0.....LA......|
+Plaintext[48]:
+| 85 22 a7 0d 85 53 37 23 e4 2e 91 e4 73 d9 69 be |."...S7#....s.i.|
+| 01 00 aa 55 3e 1d 7e 14 8e b9 c5 78 34 3f f3 bb |...U>.~....x4?..|
+| 41 68 52 e1 54 b5 09 09 09 09 09 09 09 09 09 09 |AhR.T...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| aa 55 3e 1d 7e 14 8e b9 c5 78 34 3f f3 bb 41 68 |.U>.~....x4?..Ah|
+| 52 e1 54 b5 |R.T. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #284 (first time)
+ conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f0 f1 93 67 ed 0e f9 2a 52 98 c4 24 12 a5 50 95 |...g...*R..$..P.|
+| 89 cb 96 fc 07 73 d5 af fe 66 3a 10 18 1c 5f 58 |.....s...f:..._X|
+| ef 07 b2 ec ec 2a 80 6e d5 53 00 1a 4c e2 ba ee |.....*.n.S..L...|
+Plaintext[48]:
+| f5 40 60 ee ae 6f bc 7b a7 65 5f e2 9f 96 47 6b |.@`..o.{.e_...Gk|
+| 01 00 9c 31 02 a3 11 95 d4 6e e3 9a 8e 78 75 b7 |...1.....n...xu.|
+| 8f e0 b0 dd d8 86 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 31 02 a3 11 95 d4 6e e3 9a 8e 78 75 b7 8f e0 |.1.....n...xu...|
+| b0 dd d8 86 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #289 (first time)
+ssl_session_init: initializing ptr 0x7fca45bf2ea0 size 688
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46579 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4464
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #291 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 33 e5 c3 73 96 41 ea 8b 00 3e 5c 42 69 95 5f c9 |3..s.A...>\Bi._.|
+| b5 70 41 12 23 32 36 1b 15 12 46 11 c4 3b c3 8d |.pA.#26...F..;..|
+| 98 db 5b fd e3 75 23 ec 09 55 de 3c 3c 8c d0 11 |..[..u#..U.<<...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 ed 46 99 77 1f ee fd 3c 96 9e 60 a3 a0 51 97 |..F.w...<..`..Q.|
+| 77 84 c4 58 1a 0c 41 42 11 a9 7a ad 6e 52 34 c2 |w..X..AB..z.nR4.|
+| f2 b4 b6 1b 5a 11 c9 69 e9 d6 dc 80 15 ac 90 dd |....Z..i........|
+| 21 df f0 0a 7a 88 b3 72 34 05 ec 9f 6d |!...z..r4...m |
+hash out[136]:
+| 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}|
+| 74 96 a1 b6 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 |t....K.}.*......|
+| 83 37 54 25 18 bc 84 76 39 c3 12 52 a7 6f 1f fd |.7T%...v9..R.o..|
+| ab 78 e9 4e 1b ee a0 83 da 32 62 40 99 2d 10 6b |.x.N.....2b@.-.k|
+| 47 b9 ef 3a 09 ba 87 2e 47 90 2f 9a d9 09 c3 88 |G..:....G./.....|
+| 62 e1 0d 91 5a 4a b3 c7 78 73 74 49 45 5d fb 1d |b...ZJ..xstIE]..|
+| 4e 5c 34 d1 a1 8c 3d 36 3f b9 dd f1 af 80 fe eb |N\4...=6?.......|
+| aa e9 eb 76 9b 56 96 05 3d 85 41 87 db f4 7c ec |...v.V..=.A...|.|
+| c0 42 29 28 21 37 27 8b |.B)(!7'. |
+PRF out[136]:
+| 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}|
+| 74 96 a1 b6 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 |t....K.}.*......|
+| 83 37 54 25 18 bc 84 76 39 c3 12 52 a7 6f 1f fd |.7T%...v9..R.o..|
+| ab 78 e9 4e 1b ee a0 83 da 32 62 40 99 2d 10 6b |.x.N.....2b@.-.k|
+| 47 b9 ef 3a 09 ba 87 2e 47 90 2f 9a d9 09 c3 88 |G..:....G./.....|
+| 62 e1 0d 91 5a 4a b3 c7 78 73 74 49 45 5d fb 1d |b...ZJ..xstIE]..|
+| 4e 5c 34 d1 a1 8c 3d 36 3f b9 dd f1 af 80 fe eb |N\4...=6?.......|
+| aa e9 eb 76 9b 56 96 05 3d 85 41 87 db f4 7c ec |...v.V..=.A...|.|
+| c0 42 29 28 21 37 27 8b |.B)(!7'. |
+key expansion[136]:
+| 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}|
+| 74 96 a1 b6 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 |t....K.}.*......|
+| 83 37 54 25 18 bc 84 76 39 c3 12 52 a7 6f 1f fd |.7T%...v9..R.o..|
+| ab 78 e9 4e 1b ee a0 83 da 32 62 40 99 2d 10 6b |.x.N.....2b@.-.k|
+| 47 b9 ef 3a 09 ba 87 2e 47 90 2f 9a d9 09 c3 88 |G..:....G./.....|
+| 62 e1 0d 91 5a 4a b3 c7 78 73 74 49 45 5d fb 1d |b...ZJ..xstIE]..|
+| 4e 5c 34 d1 a1 8c 3d 36 3f b9 dd f1 af 80 fe eb |N\4...=6?.......|
+| aa e9 eb 76 9b 56 96 05 3d 85 41 87 db f4 7c ec |...v.V..=.A...|.|
+| c0 42 29 28 21 37 27 8b |.B)(!7'. |
+Client MAC key[20]:
+| 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}|
+| 74 96 a1 b6 |t... |
+Server MAC key[20]:
+| 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 83 37 54 25 |.K.}.*.......7T%|
+| 18 bc 84 76 |...v |
+Client Write key[32]:
+| 39 c3 12 52 a7 6f 1f fd ab 78 e9 4e 1b ee a0 83 |9..R.o...x.N....|
+| da 32 62 40 99 2d 10 6b 47 b9 ef 3a 09 ba 87 2e |.2b@.-.kG..:....|
+Server Write key[32]:
+| 47 90 2f 9a d9 09 c3 88 62 e1 0d 91 5a 4a b3 c7 |G./.....b...ZJ..|
+| 78 73 74 49 45 5d fb 1d 4e 5c 34 d1 a1 8c 3d 36 |xstIE]..N\4...=6|
+Client Write IV[16]:
+| 3f b9 dd f1 af 80 fe eb aa e9 eb 76 9b 56 96 05 |?..........v.V..|
+Server Write IV[16]:
+| 3d 85 41 87 db f4 7c ec c0 42 29 28 21 37 27 8b |=.A...|..B)(!7'.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #293 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a...
+looking for RSA pre-master00807038a4c79396c04e7dea4cd446b1ed5f41ae4121d02d...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 1b 03 13 ae fd a9 dc 38 b1 68 f2 fd d5 f7 08 48 |.......8.h.....H|
+| b6 97 f8 f5 5b 7d f8 db b8 63 37 cd b0 0b 4e 4f |....[}...c7...NO|
+| f2 59 77 af dc 1c 4b d8 0d 15 84 a7 ea 8b e0 4d |.Yw...K........M|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 ed 46 99 77 1f ee fd 3c 96 9e 60 a3 a0 51 97 |..F.w...<..`..Q.|
+| 77 84 c4 58 1a 0c 41 42 11 a9 7a ad 6e 52 34 c2 |w..X..AB..z.nR4.|
+| f2 b4 b6 1b 5a 11 c9 69 e9 d6 dc 80 15 ac 90 dd |....Z..i........|
+| 21 df f0 0a 7a 88 b3 72 34 05 ec 9f 6d |!...z..r4...m |
+hash out[136]:
+| 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....|
+| 88 bd 55 a5 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef |..U.].k..0...U%.|
+| f1 8d 49 52 eb 66 0c a4 be c2 63 bd 95 28 20 b0 |..IR.f....c..( .|
+| 76 c1 ce d0 a6 3d a5 a8 88 96 89 60 0b f4 17 1c |v....=.....`....|
+| b3 e7 f0 af 09 bd b4 76 aa 6b c8 d7 13 d0 fb df |.......v.k......|
+| 50 45 5f af 5a 8d 79 ca b6 82 0d 94 84 75 0a a4 |PE_.Z.y......u..|
+| eb 06 07 b2 ec ec d1 80 22 18 90 b2 fa f4 3c 2c |........".....<,|
+| 8c a9 80 6a 04 45 3a 82 c3 6b 6f 6a 98 aa 77 ac |...j.E:..koj..w.|
+| 56 a3 a5 f8 69 f6 e7 82 |V...i... |
+PRF out[136]:
+| 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....|
+| 88 bd 55 a5 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef |..U.].k..0...U%.|
+| f1 8d 49 52 eb 66 0c a4 be c2 63 bd 95 28 20 b0 |..IR.f....c..( .|
+| 76 c1 ce d0 a6 3d a5 a8 88 96 89 60 0b f4 17 1c |v....=.....`....|
+| b3 e7 f0 af 09 bd b4 76 aa 6b c8 d7 13 d0 fb df |.......v.k......|
+| 50 45 5f af 5a 8d 79 ca b6 82 0d 94 84 75 0a a4 |PE_.Z.y......u..|
+| eb 06 07 b2 ec ec d1 80 22 18 90 b2 fa f4 3c 2c |........".....<,|
+| 8c a9 80 6a 04 45 3a 82 c3 6b 6f 6a 98 aa 77 ac |...j.E:..koj..w.|
+| 56 a3 a5 f8 69 f6 e7 82 |V...i... |
+key expansion[136]:
+| 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....|
+| 88 bd 55 a5 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef |..U.].k..0...U%.|
+| f1 8d 49 52 eb 66 0c a4 be c2 63 bd 95 28 20 b0 |..IR.f....c..( .|
+| 76 c1 ce d0 a6 3d a5 a8 88 96 89 60 0b f4 17 1c |v....=.....`....|
+| b3 e7 f0 af 09 bd b4 76 aa 6b c8 d7 13 d0 fb df |.......v.k......|
+| 50 45 5f af 5a 8d 79 ca b6 82 0d 94 84 75 0a a4 |PE_.Z.y......u..|
+| eb 06 07 b2 ec ec d1 80 22 18 90 b2 fa f4 3c 2c |........".....<,|
+| 8c a9 80 6a 04 45 3a 82 c3 6b 6f 6a 98 aa 77 ac |...j.E:..koj..w.|
+| 56 a3 a5 f8 69 f6 e7 82 |V...i... |
+Client MAC key[20]:
+| 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....|
+| 88 bd 55 a5 |..U. |
+Server MAC key[20]:
+| 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef f1 8d 49 52 |].k..0...U%...IR|
+| eb 66 0c a4 |.f.. |
+Client Write key[32]:
+| be c2 63 bd 95 28 20 b0 76 c1 ce d0 a6 3d a5 a8 |..c..( .v....=..|
+| 88 96 89 60 0b f4 17 1c b3 e7 f0 af 09 bd b4 76 |...`...........v|
+Server Write key[32]:
+| aa 6b c8 d7 13 d0 fb df 50 45 5f af 5a 8d 79 ca |.k......PE_.Z.y.|
+| b6 82 0d 94 84 75 0a a4 eb 06 07 b2 ec ec d1 80 |.....u..........|
+Client Write IV[16]:
+| 22 18 90 b2 fa f4 3c 2c 8c a9 80 6a 04 45 3a 82 |".....<,...j.E:.|
+Server Write IV[16]:
+| c3 6b 6f 6a 98 aa 77 ac 56 a3 a5 f8 69 f6 e7 82 |.koj..w.V...i...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 1b 03 13 ae fd a9 dc 38 b1 68 f2 fd d5 f7 08 48 |.......8.h.....H|
+| b6 97 f8 f5 5b 7d f8 db b8 63 37 cd b0 0b 4e 4f |....[}...c7...NO|
+| f2 59 77 af dc 1c 4b d8 0d 15 84 a7 ea 8b e0 4d |.Yw...K........M|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 0b 96 24 62 95 91 94 90 ec a0 3b 01 47 4b 99 51 |..$b......;.GK.Q|
+| 1f e3 13 78 56 81 e1 58 40 96 36 72 a3 f8 3b 94 |...xV..X@.6r..;.|
+| c7 6a 45 61 3f 31 d2 70 aa 2c 72 99 2c 65 a0 57 |.jEa?1.p.,r.,e.W|
+| 3c 10 7f e7 10 cf c3 af a6 c2 94 eb 6f ba b6 37 |<...........o..7|
+Plaintext[64]:
+| e0 8a 9c ba e0 b3 32 46 c8 c6 76 a9 56 a5 a1 b3 |......2F..v.V...|
+| 14 00 00 0c e3 15 e1 f4 44 37 52 ea 1c bb ff 8c |........D7R.....|
+| cb c7 c6 59 c4 53 60 8f e3 2c fe b6 35 7b c7 72 |...Y.S`..,..5{.r|
+| 78 9e e2 d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |x...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cb c7 c6 59 c4 53 60 8f e3 2c fe b6 35 7b c7 72 |...Y.S`..,..5{.r|
+| 78 9e e2 d4 |x... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #294 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 75 fd 12 94 c8 ca b7 fb 94 da 62 c9 fb 9f 43 ba |u.........b...C.|
+| 35 26 aa bd 4d 7f 22 24 6b 60 a5 8b 0f 7c ef 65 |5&..M."$k`...|.e|
+| 22 e3 89 96 cc fc 39 fe c6 4a a2 57 44 95 f0 4f |".....9..J.WD..O|
+| 76 1f 37 e6 6d 41 52 55 39 84 85 45 17 2f 24 ed |v.7.mARU9..E./$.|
+Plaintext[64]:
+| 19 9a c9 7d f7 0a 82 5f 36 6f 19 ba 64 fe ed 30 |...}..._6o..d..0|
+| 14 00 00 0c 2f ce 55 50 a4 89 5e 27 5e 2f 77 e5 |..../.UP..^'^/w.|
+| 88 b1 d6 31 2f 44 99 eb 3f c5 6c 7b 76 94 8d 55 |...1/D..?.l{v..U|
+| ed 2c 84 bb 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 b1 d6 31 2f 44 99 eb 3f c5 6c 7b 76 94 8d 55 |...1/D..?.l{v..U|
+| ed 2c 84 bb |.,.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #295 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 9a 43 84 16 63 40 06 c2 64 11 ff f6 09 88 99 d4 |.C..c@..d.......|
+| ec 48 b2 20 f7 b5 1e e1 08 b3 30 35 fd f0 b4 6d |.H. ......05...m|
+| c1 e1 91 b4 c8 b9 fb 37 f7 60 29 f7 45 19 9e 86 |.......7.`).E...|
+| 1d 3e 1e 99 a8 a4 1c 53 4f df 7c 83 49 bc af 8c |.>.....SO.|.I...|
+| a2 f4 e4 fa e9 b0 b9 22 a5 bc f1 ac f5 6e 25 09 |.......".....n%.|
+| c7 7b 5a d2 9f e5 fe 2c 5b 49 19 f7 bc 72 8d 64 |.{Z....,[I...r.d|
+| 80 79 81 4d 3a 78 cc 1d 0e cd e7 22 60 eb 69 4c |.y.M:x....."`.iL|
+| 21 90 0a e0 d3 54 9e 33 70 68 30 8e 0d 0e ef 1b |!....T.3ph0.....|
+Plaintext[128]:
+| 81 0f c6 55 32 f3 5a 6c b2 f5 a8 04 46 f1 eb 17 |...U2.Zl....F...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a be 24 31 |n.nl:4464.....$1|
+| 35 1f 16 ef c8 09 81 ae 8e 89 a7 11 2c c2 db a6 |5...........,...|
+| fc 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 40 46 b2 bd 08 3d 2d 35 ef 97 f0 50 a0 4b 7b 5e |@F...=-5...P.K{^|
+| 1a 47 61 96 |.Ga. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 46579 found (nil)
+association_find: TCP port 4464 found 0x36305a0
+
+dissect_ssl enter frame #296 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 6b e8 82 e5 c2 7a 56 76 a5 fb f4 73 12 15 89 31 |k....zVv...s...1|
+| 64 95 48 68 e6 c2 e8 8b 4f 82 45 59 d4 b9 7d 6b |d.Hh....O.EY..}k|
+| d7 af 4d b4 f7 0e c1 3c 3a ac ab a9 67 b2 04 ba |..M....<:...g...|
+| 28 93 3a 52 85 8f b5 fe 5c cb 41 38 78 2b 1e f2 |(.:R....\.A8x+..|
+| 01 12 ca bb b9 5a 19 52 1d e5 1f ab 61 94 c9 ef |.....Z.R....a...|
+| ad 31 87 f4 f0 3c f4 f3 9c 3f 45 47 b0 48 c7 a0 |.1...<...?EG.H..|
+| 28 b7 6f 9a 92 c2 69 58 9c 56 8e a7 16 9f d5 cf |(.o...iX.V......|
+| 7a a8 63 70 d0 75 67 84 ce d2 73 be f5 7e 63 d3 |z.cp.ug...s..~c.|
+| 8f 42 1a f1 8b 92 0c 5a 04 68 79 49 4f cc 7a e7 |.B.....Z.hyIO.z.|
+| 52 49 5a a4 c7 99 65 fe a5 d0 c9 8c e1 56 76 2e |RIZ...e......Vv.|
+| 13 77 91 42 d6 77 ce 6f 4c a3 db 06 9e cd 53 17 |.w.B.w.oL.....S.|
+| 4a 72 ea a5 0a 26 c7 e7 e6 b3 6f 6a 8b c8 88 e2 |Jr...&....oj....|
+| d6 ef 98 a0 bf 9a df 28 55 ea 38 95 36 30 49 e4 |.......(U.8.60I.|
+| 65 03 61 cf 8a d5 dd d4 e1 ad 1f 1e 36 24 c4 e3 |e.a.........6$..|
+| 8d 0d f9 e1 8c e8 40 98 44 56 0a f8 88 49 31 2b |......@.DV...I1+|
+| c5 15 1f 4e 58 54 21 5f 20 65 06 88 e4 4e f3 05 |...NXT!_ e...N..|
+| 42 83 94 9b e3 94 ea d2 63 9e c3 1b 73 15 58 61 |B.......c...s.Xa|
+| f0 5a a9 49 e5 10 e0 af 22 49 8b 6c e2 f5 8e 5c |.Z.I...."I.l...\|
+| 62 73 a3 ad 76 ee f3 5a 52 92 0d 68 f8 ec 72 62 |bs..v..ZR..h..rb|
+| 0e 6e 88 42 84 66 72 32 31 a0 eb 36 f6 33 94 18 |.n.B.fr21..6.3..|
+| 49 94 3e d2 dd 5a 17 c6 54 c9 66 b0 01 62 76 eb |I.>..Z..T.f..bv.|
+| 82 eb d6 d0 f1 f3 85 0d c5 87 f0 1c 49 59 25 fa |............IY%.|
+| 8d 43 6a a5 6f 5a 4a 0a 2a 3d cf 4f 1a 31 0d c8 |.Cj.oZJ.*=.O.1..|
+| 7d 9d 2b ec f3 39 2b 04 9e 91 e3 5e c7 b5 9c 35 |}.+..9+....^...5|
+| 8a 4f a1 6e 0c 91 e7 98 d2 73 fa 3a 73 f2 3c 99 |.O.n.....s.:s.<.|
+Plaintext[400]:
+| ff 2c a7 66 a5 c7 df e2 a0 ad 8f 9d 24 1e 0d 5f |.,.f........$.._|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 84 20 dd 1a 5d aa 4c f5 f8 3b bd fc f5 b9 6a 25 |. ..].L..;....j%|
+| 93 e6 5f c8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.._.............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ae 29 50 a8 b9 8b 36 97 e7 3b d4 5f d8 e0 8a a5 |.)P...6..;._....|
+| 30 e5 c5 e6 |0... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4464 found 0x36305a0
+
+dissect_ssl enter frame #297 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ec e9 5a 96 6b 6c d5 d9 7f c1 fc 9c 3a a1 91 76 |..Z.kl......:..v|
+| d0 2f 62 4f ac ab 1d a7 a0 9d 42 8e 09 91 81 01 |./bO......B.....|
+| 66 8e e6 e5 07 43 6a f8 4d cf b8 9d 8e 38 5b c9 |f....Cj.M....8[.|
+Plaintext[48]:
+| aa ce 7e 1a 9d bd be 52 d0 0c ee ff c0 5a df 12 |..~....R.....Z..|
+| 01 00 ab dc c8 a6 da 20 4c ce 51 25 d3 44 86 59 |....... L.Q%.D.Y|
+| da 55 da 52 c7 be 09 09 09 09 09 09 09 09 09 09 |.U.R............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ab dc c8 a6 da 20 4c ce 51 25 d3 44 86 59 da 55 |..... L.Q%.D.Y.U|
+| da 52 c7 be |.R.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #299 (first time)
+ conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 81 79 78 6a 19 33 37 a7 10 2f f5 57 3f ee 41 02 |.yxj.37../.W?.A.|
+| 1f 0d 52 c0 aa 93 f2 48 6a 54 4d 48 78 59 c8 bc |..R....HjTMHxY..|
+| 30 aa 2d e3 ed a0 d7 5f 4b 94 ea e6 2f a9 1a 03 |0.-...._K.../...|
+Plaintext[48]:
+| 75 0c 52 4c 5d a6 a7 e0 fa 75 00 bb 0d 3c c9 6d |u.RL]....u...<.m|
+| 01 00 8c b1 63 cb 89 ef 73 ca 3c 63 ab 79 a9 cc |....c...s.<c.y..|
+| 0d 13 af ed e1 e2 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c b1 63 cb 89 ef 73 ca 3c 63 ab 79 a9 cc 0d 13 |..c...s.<c.y....|
+| af ed e1 e2 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #304 (first time)
+ssl_session_init: initializing ptr 0x7fca45bf53a0 size 688
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56921 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4465
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #306 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 1b 03 13 ae fd a9 dc 38 b1 68 f2 fd d5 f7 08 48 |.......8.h.....H|
+| b6 97 f8 f5 5b 7d f8 db b8 63 37 cd b0 0b 4e 4f |....[}...c7...NO|
+| f2 59 77 af dc 1c 4b d8 0d 15 84 a7 ea 8b e0 4d |.Yw...K........M|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 33 0e a5 ed f6 5f 3f bf ec e5 9d 50 33 d2 91 |.3...._?....P3..|
+| 5b 04 62 5c a5 bb 93 40 34 ea a9 86 eb 52 34 c2 |[.b\...@4....R4.|
+| f2 8e 1f 7f 2a 7a ca 2e 9c 71 ff b4 7e d2 d8 46 |....*z...q..~..F|
+| d1 1d 72 3e 2b 9d 4a 44 e4 1c 19 ec d8 |..r>+.JD..... |
+hash out[136]:
+| ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....|
+| 17 72 89 d5 c0 ef fd a6 27 93 bd 49 47 db b3 3d |.r......'..IG..=|
+| 9f 21 e4 a6 c1 8e 26 fd 5e fa 9e 87 d8 a7 81 5f |.!....&.^......_|
+| 8d 35 ab 15 3a 32 5a a4 74 62 76 88 14 e6 0e 4b |.5..:2Z.tbv....K|
+| d6 6a 86 8b f9 9e a0 0d aa 10 11 0e d2 31 bb 26 |.j...........1.&|
+| f5 ad d0 d1 87 b8 55 6d d3 a0 85 f1 48 22 fd f4 |......Um....H"..|
+| 24 77 58 67 8b 6c f7 75 62 85 63 c6 9c cf 2e 78 |$wXg.l.ub.c....x|
+| e7 c0 a2 9d 62 a9 1f 79 f1 3a e7 3f ea e2 8a 21 |....b..y.:.?...!|
+| 0b 1e 12 39 c1 55 5d a5 |...9.U]. |
+PRF out[136]:
+| ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....|
+| 17 72 89 d5 c0 ef fd a6 27 93 bd 49 47 db b3 3d |.r......'..IG..=|
+| 9f 21 e4 a6 c1 8e 26 fd 5e fa 9e 87 d8 a7 81 5f |.!....&.^......_|
+| 8d 35 ab 15 3a 32 5a a4 74 62 76 88 14 e6 0e 4b |.5..:2Z.tbv....K|
+| d6 6a 86 8b f9 9e a0 0d aa 10 11 0e d2 31 bb 26 |.j...........1.&|
+| f5 ad d0 d1 87 b8 55 6d d3 a0 85 f1 48 22 fd f4 |......Um....H"..|
+| 24 77 58 67 8b 6c f7 75 62 85 63 c6 9c cf 2e 78 |$wXg.l.ub.c....x|
+| e7 c0 a2 9d 62 a9 1f 79 f1 3a e7 3f ea e2 8a 21 |....b..y.:.?...!|
+| 0b 1e 12 39 c1 55 5d a5 |...9.U]. |
+key expansion[136]:
+| ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....|
+| 17 72 89 d5 c0 ef fd a6 27 93 bd 49 47 db b3 3d |.r......'..IG..=|
+| 9f 21 e4 a6 c1 8e 26 fd 5e fa 9e 87 d8 a7 81 5f |.!....&.^......_|
+| 8d 35 ab 15 3a 32 5a a4 74 62 76 88 14 e6 0e 4b |.5..:2Z.tbv....K|
+| d6 6a 86 8b f9 9e a0 0d aa 10 11 0e d2 31 bb 26 |.j...........1.&|
+| f5 ad d0 d1 87 b8 55 6d d3 a0 85 f1 48 22 fd f4 |......Um....H"..|
+| 24 77 58 67 8b 6c f7 75 62 85 63 c6 9c cf 2e 78 |$wXg.l.ub.c....x|
+| e7 c0 a2 9d 62 a9 1f 79 f1 3a e7 3f ea e2 8a 21 |....b..y.:.?...!|
+| 0b 1e 12 39 c1 55 5d a5 |...9.U]. |
+Client MAC key[20]:
+| ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....|
+| 17 72 89 d5 |.r.. |
+Server MAC key[20]:
+| c0 ef fd a6 27 93 bd 49 47 db b3 3d 9f 21 e4 a6 |....'..IG..=.!..|
+| c1 8e 26 fd |..&. |
+Client Write key[32]:
+| 5e fa 9e 87 d8 a7 81 5f 8d 35 ab 15 3a 32 5a a4 |^......_.5..:2Z.|
+| 74 62 76 88 14 e6 0e 4b d6 6a 86 8b f9 9e a0 0d |tbv....K.j......|
+Server Write key[32]:
+| aa 10 11 0e d2 31 bb 26 f5 ad d0 d1 87 b8 55 6d |.....1.&......Um|
+| d3 a0 85 f1 48 22 fd f4 24 77 58 67 8b 6c f7 75 |....H"..$wXg.l.u|
+Client Write IV[16]:
+| 62 85 63 c6 9c cf 2e 78 e7 c0 a2 9d 62 a9 1f 79 |b.c....x....b..y|
+Server Write IV[16]:
+| f1 3a e7 3f ea e2 8a 21 0b 1e 12 39 c1 55 5d a5 |.:.?...!...9.U].|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #308 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b...
+looking for RSA pre-master00804d88cc113cda54ce368ddfcda4f342764a662dfa3a39...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 84 c3 e2 c9 72 70 90 8b 22 af 4a 2d 26 9f 7c 0a |....rp..".J-&.|.|
+| 63 75 b1 84 fe 4b 36 5d af c8 ba 92 57 78 72 7a |cu...K6]....Wxrz|
+| 6d 29 6f 11 e9 b9 4c b9 64 36 42 e6 5d c4 7e 56 |m)o...L.d6B.].~V|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 33 0e a5 ed f6 5f 3f bf ec e5 9d 50 33 d2 91 |.3...._?....P3..|
+| 5b 04 62 5c a5 bb 93 40 34 ea a9 86 eb 52 34 c2 |[.b\...@4....R4.|
+| f2 8e 1f 7f 2a 7a ca 2e 9c 71 ff b4 7e d2 d8 46 |....*z...q..~..F|
+| d1 1d 72 3e 2b 9d 4a 44 e4 1c 19 ec d8 |..r>+.JD..... |
+hash out[136]:
+| fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<|
+| f3 fb 29 20 d1 fd 81 df cb 96 f4 bf 4e da d1 d0 |..) ........N...|
+| 83 2f 6a 20 23 95 fe 65 63 e6 71 a4 33 05 33 0b |./j #..ec.q.3.3.|
+| 49 b9 0d 1e ac b2 b6 37 c5 e8 2b 8d 7c 81 67 27 |I......7..+.|.g'|
+| 9e e4 cd 8e ab b2 17 5a 94 b6 db 45 fa 10 2c 26 |.......Z...E..,&|
+| 84 e0 5c 29 fb d7 35 02 d2 fe 9b f0 92 08 67 e4 |..\)..5.......g.|
+| 1d 6e 0e 3f 3f cb a3 83 45 92 2c 04 7f 9f 69 e6 |.n.??...E.,...i.|
+| 38 d6 89 74 29 b6 15 5c b8 f4 26 a6 42 50 4f e5 |8..t)..\..&.BPO.|
+| cc b0 49 9e 3e 77 c9 bd |..I.>w.. |
+PRF out[136]:
+| fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<|
+| f3 fb 29 20 d1 fd 81 df cb 96 f4 bf 4e da d1 d0 |..) ........N...|
+| 83 2f 6a 20 23 95 fe 65 63 e6 71 a4 33 05 33 0b |./j #..ec.q.3.3.|
+| 49 b9 0d 1e ac b2 b6 37 c5 e8 2b 8d 7c 81 67 27 |I......7..+.|.g'|
+| 9e e4 cd 8e ab b2 17 5a 94 b6 db 45 fa 10 2c 26 |.......Z...E..,&|
+| 84 e0 5c 29 fb d7 35 02 d2 fe 9b f0 92 08 67 e4 |..\)..5.......g.|
+| 1d 6e 0e 3f 3f cb a3 83 45 92 2c 04 7f 9f 69 e6 |.n.??...E.,...i.|
+| 38 d6 89 74 29 b6 15 5c b8 f4 26 a6 42 50 4f e5 |8..t)..\..&.BPO.|
+| cc b0 49 9e 3e 77 c9 bd |..I.>w.. |
+key expansion[136]:
+| fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<|
+| f3 fb 29 20 d1 fd 81 df cb 96 f4 bf 4e da d1 d0 |..) ........N...|
+| 83 2f 6a 20 23 95 fe 65 63 e6 71 a4 33 05 33 0b |./j #..ec.q.3.3.|
+| 49 b9 0d 1e ac b2 b6 37 c5 e8 2b 8d 7c 81 67 27 |I......7..+.|.g'|
+| 9e e4 cd 8e ab b2 17 5a 94 b6 db 45 fa 10 2c 26 |.......Z...E..,&|
+| 84 e0 5c 29 fb d7 35 02 d2 fe 9b f0 92 08 67 e4 |..\)..5.......g.|
+| 1d 6e 0e 3f 3f cb a3 83 45 92 2c 04 7f 9f 69 e6 |.n.??...E.,...i.|
+| 38 d6 89 74 29 b6 15 5c b8 f4 26 a6 42 50 4f e5 |8..t)..\..&.BPO.|
+| cc b0 49 9e 3e 77 c9 bd |..I.>w.. |
+Client MAC key[20]:
+| fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<|
+| f3 fb 29 20 |..) |
+Server MAC key[20]:
+| d1 fd 81 df cb 96 f4 bf 4e da d1 d0 83 2f 6a 20 |........N..../j |
+| 23 95 fe 65 |#..e |
+Client Write key[32]:
+| 63 e6 71 a4 33 05 33 0b 49 b9 0d 1e ac b2 b6 37 |c.q.3.3.I......7|
+| c5 e8 2b 8d 7c 81 67 27 9e e4 cd 8e ab b2 17 5a |..+.|.g'.......Z|
+Server Write key[32]:
+| 94 b6 db 45 fa 10 2c 26 84 e0 5c 29 fb d7 35 02 |...E..,&..\)..5.|
+| d2 fe 9b f0 92 08 67 e4 1d 6e 0e 3f 3f cb a3 83 |......g..n.??...|
+Client Write IV[16]:
+| 45 92 2c 04 7f 9f 69 e6 38 d6 89 74 29 b6 15 5c |E.,...i.8..t)..\|
+Server Write IV[16]:
+| b8 f4 26 a6 42 50 4f e5 cc b0 49 9e 3e 77 c9 bd |..&.BPO...I.>w..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 84 c3 e2 c9 72 70 90 8b 22 af 4a 2d 26 9f 7c 0a |....rp..".J-&.|.|
+| 63 75 b1 84 fe 4b 36 5d af c8 ba 92 57 78 72 7a |cu...K6]....Wxrz|
+| 6d 29 6f 11 e9 b9 4c b9 64 36 42 e6 5d c4 7e 56 |m)o...L.d6B.].~V|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1a 55 88 c1 9f 0f d6 5e da 3c 73 ef c6 17 a1 3c |.U.....^.<s....<|
+| d0 d5 aa 68 32 b1 c4 75 79 44 76 77 dc 9c 11 10 |...h2..uyDvw....|
+| b8 a6 07 d0 2a 16 76 80 ef 1a 02 35 85 c3 ed 67 |....*.v....5...g|
+| 9c 3f e2 0d 88 fd 9c 2f e6 63 5e e6 01 0e ec 15 |.?...../.c^.....|
+Plaintext[64]:
+| 72 b5 0e 3e 5c 95 0b 91 8f e1 76 50 59 2c 9e 6a |r..>\.....vPY,.j|
+| 14 00 00 0c 4b f0 5f b7 32 41 3a 9d 41 51 4e cc |....K._.2A:.AQN.|
+| d4 a5 63 5b 3d 79 04 49 19 81 53 5d 7d ee 7c df |..c[=y.I..S]}.|.|
+| 6c 1a 8e 93 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |l...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d4 a5 63 5b 3d 79 04 49 19 81 53 5d 7d ee 7c df |..c[=y.I..S]}.|.|
+| 6c 1a 8e 93 |l... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #309 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b2 15 62 04 f5 45 46 d5 54 55 1c d5 d7 e0 97 93 |..b..EF.TU......|
+| 33 14 84 c4 cd 46 f8 99 80 d1 a3 89 b1 21 78 f2 |3....F.......!x.|
+| e5 0a a8 c7 9e aa be 85 cf bf 40 be a6 42 91 f5 |..........@..B..|
+| f8 47 bd 04 59 77 0c b9 ed 11 69 54 f9 de dc 96 |.G..Yw....iT....|
+Plaintext[64]:
+| 47 b1 37 89 df e1 0c 1c 7b 44 94 bd 72 45 c4 65 |G.7.....{D..rE.e|
+| 14 00 00 0c fa e6 ee 90 89 c9 c9 c9 0f e8 93 6d |...............m|
+| ac 18 89 13 3b 0b f7 20 17 f2 69 dd 4d eb 97 82 |....;.. ..i.M...|
+| e8 4f 23 6c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.O#l............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ac 18 89 13 3b 0b f7 20 17 f2 69 dd 4d eb 97 82 |....;.. ..i.M...|
+| e8 4f 23 6c |.O#l |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #310 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 1a b9 46 1f 0a d9 7b ec 5d bf ee 9f da d4 33 17 |..F...{.].....3.|
+| 0e ed 40 db 88 94 87 02 c6 d2 1f 27 95 2d 4c 11 |..@........'.-L.|
+| 03 39 00 df 5d 23 6b 13 5e b4 9f ef 31 8c 70 30 |.9..]#k.^...1.p0|
+| 19 44 a4 6a 3f 33 a1 bd 9a a4 e3 fb 32 29 20 11 |.D.j?3......2) .|
+| 09 9f 57 86 f8 de 05 40 38 19 89 37 79 45 96 20 |..W....@8..7yE. |
+| a3 e9 92 71 7f 1b 15 51 c4 22 a5 71 6e e6 31 77 |...q...Q.".qn.1w|
+| 33 ac 7b 27 99 ec 67 9b 76 cf e9 2d 60 03 9a 53 |3.{'..g.v..-`..S|
+| a5 49 0b 8a da dc 9d aa 09 66 ab 60 86 6f 46 47 |.I.......f.`.oFG|
+Plaintext[128]:
+| e6 9c e9 51 f3 1e dc 4d 9e 79 0c 93 97 17 b7 c4 |...Q...M.y......|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a fa 96 cf |n.nl:4465.......|
+| 76 c7 99 a2 66 67 44 4e 35 14 14 76 14 c8 3c 1a |v...fgDN5..v..<.|
+| 07 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 80 b7 f4 87 73 1a 76 ba d9 2d cc db 86 2e 67 17 |....s.v..-....g.|
+| 3b 35 43 1f |;5C. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56921 found (nil)
+association_find: TCP port 4465 found 0x36d4d60
+
+dissect_ssl enter frame #311 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 22 dd 8c 13 9e c8 ca 43 8d da cc 0f 19 70 ec 4d |"......C.....p.M|
+| 34 fe c2 32 a4 e7 f5 fd 12 ac dd 0e 98 e5 a8 c5 |4..2............|
+| 38 5a da ba e5 ac 6a 4b 15 69 e5 59 19 22 7e e3 |8Z....jK.i.Y."~.|
+| dd db b6 cf 27 f9 8a 6b 5c c6 18 a5 b6 23 d0 69 |....'..k\....#.i|
+| cc 91 0d ce d4 d0 a3 18 d8 7b c8 48 fb d5 c3 6d |.........{.H...m|
+| b4 0c fd 0a 1e c6 f6 95 56 42 7a ca 57 6e eb 88 |........VBz.Wn..|
+| 10 b7 13 8b a8 50 c4 73 0e b7 e2 8d 17 a7 21 86 |.....P.s......!.|
+| de 32 1e 70 90 21 4c 7c 25 cc 52 d5 ef 82 8d 22 |.2.p.!L|%.R...."|
+| 1c 83 0e a5 4b ba 09 0d 1f 9c d3 98 40 1f 78 63 |....K.......@.xc|
+| f3 80 0a 1c 8a 76 57 df 41 dc 12 b4 09 66 5e 4a |.....vW.A....f^J|
+| 0e 8e b6 67 ff 3f 89 9d da d3 0d 05 0b bf 42 8d |...g.?........B.|
+| c1 9f d0 fe f5 81 dd 99 7f 8b 32 4c 61 63 aa 53 |..........2Lac.S|
+| 54 fa b1 9b 74 b5 00 d1 64 12 22 e2 dd a6 34 9f |T...t...d."...4.|
+| b8 bb af 5d f1 d2 0a 82 7a db 78 c3 a0 58 d6 d7 |...]....z.x..X..|
+| 40 20 56 ce 24 5c 2f 7f a8 12 1a ed 90 72 b1 7a |@ V.$\/......r.z|
+| 00 97 89 31 0c a1 7e c3 30 7c 59 a1 64 8b e4 ca |...1..~.0|Y.d...|
+| 2c ea b8 db b8 2e cd 18 bf f0 9a 15 8e 05 20 99 |,............. .|
+| 95 a8 b0 04 e8 20 51 e4 6d 89 13 00 3d 73 7e 15 |..... Q.m...=s~.|
+| fa 1c 4b 82 c9 d1 fa 27 74 63 b7 a4 55 88 65 cb |..K....'tc..U.e.|
+| 90 fd ba 63 13 4f c2 40 21 22 b2 41 ad 38 c1 16 |...c.O.@!".A.8..|
+| 34 d8 63 a0 9a a6 47 ac 85 01 59 9d 04 f0 48 bf |4.c...G...Y...H.|
+| a4 26 93 2d 55 ed 5e f2 a0 27 dc 06 7a 47 ec 4f |.&.-U.^..'..zG.O|
+| de bf c8 2a b0 a0 74 48 73 88 a3 34 58 d4 0a b5 |...*..tHs..4X...|
+| 28 01 18 83 45 6d da 1b e3 31 f8 31 da 16 a0 0f |(...Em...1.1....|
+| c7 a8 46 65 29 f0 59 c2 8b 95 96 48 cc a8 4d ee |..Fe).Y....H..M.|
+Plaintext[400]:
+| 4c 82 27 c0 40 13 7f 8a 53 05 38 36 c2 2d 1b 1d |L.'.@...S.86.-..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 44 50 90 5b 6a 0e 27 0e 1c 80 27 bc ce 00 01 e3 |DP.[j.'...'.....|
+| 7a 0f 53 6a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |z.Sj............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 77 be 30 bb e6 7c 2e c4 13 bf 69 ec de 97 50 3c |w.0..|....i...P<|
+| 19 9f 5c 05 |..\. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4465 found 0x36d4d60
+
+dissect_ssl enter frame #312 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3b 08 67 d6 c7 54 6e 2d d4 8b 0e 88 cf 90 a1 f8 |;.g..Tn-........|
+| c7 ab 6f 0b 4a 3b bd 98 33 58 b1 88 0f ce e9 7e |..o.J;..3X.....~|
+| 13 63 3f 70 b7 cb 4e e7 d5 df 69 8e 32 66 5c ac |.c?p..N...i.2f\.|
+Plaintext[48]:
+| 22 61 6e 6b 1b 54 86 db 38 b3 75 7b 8b 96 de 52 |"ank.T..8.u{...R|
+| 01 00 70 73 7e 89 f6 a6 ec c9 a1 1c 62 ce dc ee |..ps~.......b...|
+| b0 60 ee a4 59 d0 09 09 09 09 09 09 09 09 09 09 |.`..Y...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 70 73 7e 89 f6 a6 ec c9 a1 1c 62 ce dc ee b0 60 |ps~.......b....`|
+| ee a4 59 d0 |..Y. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #314 (first time)
+ conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ea b4 de 97 0c 0a 68 1c 8d bf ee 71 6f 17 dd 85 |......h....qo...|
+| ef 83 97 42 b5 4e 7a 2d 8e 05 ce c1 94 f9 6a 3c |...B.Nz-......j<|
+| bb 49 5b b2 0d 64 b5 a2 02 77 b9 eb 58 50 cf ac |.I[..d...w..XP..|
+Plaintext[48]:
+| a4 eb 12 db 0b 34 01 d4 d8 26 e0 17 c7 35 24 46 |.....4...&...5$F|
+| 01 00 90 e9 3f e7 a2 40 73 45 9d f4 fc 26 5e 6c |....?..@sE...&^l|
+| 9d 9a be 82 fd 5d 09 09 09 09 09 09 09 09 09 09 |.....]..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 90 e9 3f e7 a2 40 73 45 9d f4 fc 26 5e 6c 9d 9a |..?..@sE...&^l..|
+| be 82 fd 5d |...] |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #319 (first time)
+ssl_session_init: initializing ptr 0x7fca45bf78a0 size 688
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47266 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4470
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #321 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 84 c3 e2 c9 72 70 90 8b 22 af 4a 2d 26 9f 7c 0a |....rp..".J-&.|.|
+| 63 75 b1 84 fe 4b 36 5d af c8 ba 92 57 78 72 7a |cu...K6]....Wxrz|
+| 6d 29 6f 11 e9 b9 4c b9 64 36 42 e6 5d c4 7e 56 |m)o...L.d6B.].~V|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 96 8a a5 1a 4e a2 8b ca b9 08 d2 a0 a5 01 1e |.....N..........|
+| b8 47 de 99 e3 8f 01 4d b5 35 71 e9 2d 52 34 c2 |.G.....M.5q.-R4.|
+| f2 3b b1 ff 6b 1a 56 7c ab 27 45 81 ce 4a e5 9f |.;..k.V|.'E..J..|
+| fe 8a 2e 43 ae 2d ef e2 af d7 88 66 33 |...C.-.....f3 |
+hash out[104]:
+| a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........|
+| 34 00 f3 7b 6b a1 95 e1 72 69 06 79 f7 4d 87 93 |4..{k...ri.y.M..|
+| b7 28 92 68 ef 09 93 ea 55 a3 ea 0a 9a 28 cc 32 |.(.h....U....(.2|
+| ed 05 0a ee 22 75 59 dd 91 a6 2d 95 96 6b 22 9f |...."uY...-..k".|
+| e4 7a 01 df f9 d2 20 a8 7a 73 50 a1 59 2a 18 1f |.z.... .zsP.Y*..|
+| 30 18 5e ea c0 6b 07 d4 95 92 2a 29 ab 1b 6c f8 |0.^..k....*)..l.|
+| 7a 8c 5b 75 df ee a8 4b |z.[u...K |
+PRF out[104]:
+| a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........|
+| 34 00 f3 7b 6b a1 95 e1 72 69 06 79 f7 4d 87 93 |4..{k...ri.y.M..|
+| b7 28 92 68 ef 09 93 ea 55 a3 ea 0a 9a 28 cc 32 |.(.h....U....(.2|
+| ed 05 0a ee 22 75 59 dd 91 a6 2d 95 96 6b 22 9f |...."uY...-..k".|
+| e4 7a 01 df f9 d2 20 a8 7a 73 50 a1 59 2a 18 1f |.z.... .zsP.Y*..|
+| 30 18 5e ea c0 6b 07 d4 95 92 2a 29 ab 1b 6c f8 |0.^..k....*)..l.|
+| 7a 8c 5b 75 df ee a8 4b |z.[u...K |
+key expansion[104]:
+| a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........|
+| 34 00 f3 7b 6b a1 95 e1 72 69 06 79 f7 4d 87 93 |4..{k...ri.y.M..|
+| b7 28 92 68 ef 09 93 ea 55 a3 ea 0a 9a 28 cc 32 |.(.h....U....(.2|
+| ed 05 0a ee 22 75 59 dd 91 a6 2d 95 96 6b 22 9f |...."uY...-..k".|
+| e4 7a 01 df f9 d2 20 a8 7a 73 50 a1 59 2a 18 1f |.z.... .zsP.Y*..|
+| 30 18 5e ea c0 6b 07 d4 95 92 2a 29 ab 1b 6c f8 |0.^..k....*)..l.|
+| 7a 8c 5b 75 df ee a8 4b |z.[u...K |
+Client MAC key[20]:
+| a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........|
+| 34 00 f3 7b |4..{ |
+Server MAC key[20]:
+| 6b a1 95 e1 72 69 06 79 f7 4d 87 93 b7 28 92 68 |k...ri.y.M...(.h|
+| ef 09 93 ea |.... |
+Client Write key[16]:
+| 55 a3 ea 0a 9a 28 cc 32 ed 05 0a ee 22 75 59 dd |U....(.2...."uY.|
+Server Write key[16]:
+| 91 a6 2d 95 96 6b 22 9f e4 7a 01 df f9 d2 20 a8 |..-..k"..z.... .|
+Client Write IV[16]:
+| 7a 73 50 a1 59 2a 18 1f 30 18 5e ea c0 6b 07 d4 |zsP.Y*..0.^..k..|
+Server Write IV[16]:
+| 95 92 2a 29 ab 1b 6c f8 7a 8c 5b 75 df ee a8 4b |..*)..l.z.[u...K|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #323 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae...
+looking for RSA pre-master3268780686b49c1ee5fe55a7ec53579d8d7d715a5c8b4d15...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 a3 38 e2 e5 74 ed de 13 cd 97 3b 3e 3b 53 ee |..8..t.....;>;S.|
+| 76 fa 23 ae 64 7c e6 07 b9 ed 3a 69 1e dd 60 fa |v.#.d|....:i..`.|
+| e4 00 b8 76 72 9b 99 e2 aa bc ec 18 8a 72 b9 60 |...vr........r.`|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 96 8a a5 1a 4e a2 8b ca b9 08 d2 a0 a5 01 1e |.....N..........|
+| b8 47 de 99 e3 8f 01 4d b5 35 71 e9 2d 52 34 c2 |.G.....M.5q.-R4.|
+| f2 3b b1 ff 6b 1a 56 7c ab 27 45 81 ce 4a e5 9f |.;..k.V|.'E..J..|
+| fe 8a 2e 43 ae 2d ef e2 af d7 88 66 33 |...C.-.....f3 |
+hash out[104]:
+| 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.|
+| be 60 00 c8 ef 46 2b 75 39 8e 35 cc 75 3b c0 66 |.`...F+u9.5.u;.f|
+| 1a 04 07 67 5d 2f 88 63 aa 9e 5e e3 a2 52 b6 c9 |...g]/.c..^..R..|
+| ec 00 d5 2c a4 d6 96 7a 60 b6 ee e9 76 fc 5c 8b |...,...z`...v.\.|
+| 3a 92 81 47 7a db 36 ef a8 80 f0 8f a9 15 31 9c |:..Gz.6.......1.|
+| 53 7e 8d 7f 6f cb d5 ef c0 17 34 1e 35 84 9b 2b |S~..o.....4.5..+|
+| 5b ce 49 bc 39 37 22 bc |[.I.97". |
+PRF out[104]:
+| 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.|
+| be 60 00 c8 ef 46 2b 75 39 8e 35 cc 75 3b c0 66 |.`...F+u9.5.u;.f|
+| 1a 04 07 67 5d 2f 88 63 aa 9e 5e e3 a2 52 b6 c9 |...g]/.c..^..R..|
+| ec 00 d5 2c a4 d6 96 7a 60 b6 ee e9 76 fc 5c 8b |...,...z`...v.\.|
+| 3a 92 81 47 7a db 36 ef a8 80 f0 8f a9 15 31 9c |:..Gz.6.......1.|
+| 53 7e 8d 7f 6f cb d5 ef c0 17 34 1e 35 84 9b 2b |S~..o.....4.5..+|
+| 5b ce 49 bc 39 37 22 bc |[.I.97". |
+key expansion[104]:
+| 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.|
+| be 60 00 c8 ef 46 2b 75 39 8e 35 cc 75 3b c0 66 |.`...F+u9.5.u;.f|
+| 1a 04 07 67 5d 2f 88 63 aa 9e 5e e3 a2 52 b6 c9 |...g]/.c..^..R..|
+| ec 00 d5 2c a4 d6 96 7a 60 b6 ee e9 76 fc 5c 8b |...,...z`...v.\.|
+| 3a 92 81 47 7a db 36 ef a8 80 f0 8f a9 15 31 9c |:..Gz.6.......1.|
+| 53 7e 8d 7f 6f cb d5 ef c0 17 34 1e 35 84 9b 2b |S~..o.....4.5..+|
+| 5b ce 49 bc 39 37 22 bc |[.I.97". |
+Client MAC key[20]:
+| 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.|
+| be 60 00 c8 |.`.. |
+Server MAC key[20]:
+| ef 46 2b 75 39 8e 35 cc 75 3b c0 66 1a 04 07 67 |.F+u9.5.u;.f...g|
+| 5d 2f 88 63 |]/.c |
+Client Write key[16]:
+| aa 9e 5e e3 a2 52 b6 c9 ec 00 d5 2c a4 d6 96 7a |..^..R.....,...z|
+Server Write key[16]:
+| 60 b6 ee e9 76 fc 5c 8b 3a 92 81 47 7a db 36 ef |`...v.\.:..Gz.6.|
+Client Write IV[16]:
+| a8 80 f0 8f a9 15 31 9c 53 7e 8d 7f 6f cb d5 ef |......1.S~..o...|
+Server Write IV[16]:
+| c0 17 34 1e 35 84 9b 2b 5b ce 49 bc 39 37 22 bc |..4.5..+[.I.97".|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 83 a3 38 e2 e5 74 ed de 13 cd 97 3b 3e 3b 53 ee |..8..t.....;>;S.|
+| 76 fa 23 ae 64 7c e6 07 b9 ed 3a 69 1e dd 60 fa |v.#.d|....:i..`.|
+| e4 00 b8 76 72 9b 99 e2 aa bc ec 18 8a 72 b9 60 |...vr........r.`|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 3a 51 6d ce 6b e8 15 c5 ce c1 ae 3a 60 8d ab e0 |:Qm.k......:`...|
+| 84 12 a7 c1 40 8e e8 10 55 c0 16 ec 09 e5 c9 e3 |....@...U.......|
+| 77 a6 f3 75 df fd 80 9d 74 56 6d 66 93 29 ad 97 |w..u....tVmf.)..|
+| e7 a0 81 dd 72 c8 a4 7f a3 37 19 9a 9e ea 07 af |....r....7......|
+Plaintext[64]:
+| e7 36 18 7a 55 9b f4 d5 9b 85 6d b5 58 5c 9d 71 |.6.zU.....m.X\.q|
+| 14 00 00 0c ca dd 7f 75 d6 6d ec 47 40 fc a4 20 |.......u.m.G@.. |
+| e1 3e 35 be 50 3d d1 fd 51 5d 69 b1 6f ac 7e e0 |.>5.P=..Q]i.o.~.|
+| 02 ed 63 d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..c.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 3e 35 be 50 3d d1 fd 51 5d 69 b1 6f ac 7e e0 |.>5.P=..Q]i.o.~.|
+| 02 ed 63 d4 |..c. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #324 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 17 2e 30 29 0e 39 92 39 7c 4a e8 d6 67 94 6c af |..0).9.9|J..g.l.|
+| f7 89 65 78 20 25 d2 cf ba 3f bb aa 5a 4f 4e 30 |..ex %...?..ZON0|
+| 01 e3 e3 0b d3 3f e4 56 62 06 f2 7c 48 94 17 13 |.....?.Vb..|H...|
+| d1 42 6d 10 4c ed 49 0d 25 ff 9d 5d 09 c3 95 f6 |.Bm.L.I.%..]....|
+Plaintext[64]:
+| 4f bf 83 61 ab 37 6c e5 42 0a 64 0a 48 19 37 d0 |O..a.7l.B.d.H.7.|
+| 14 00 00 0c 51 5f d9 f7 72 31 c3 1d 90 65 ef 31 |....Q_..r1...e.1|
+| 44 33 7b 78 5b bd 49 78 bf 73 96 51 66 57 3a 4a |D3{x[.Ix.s.QfW:J|
+| a0 af 3f d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..?.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 44 33 7b 78 5b bd 49 78 bf 73 96 51 66 57 3a 4a |D3{x[.Ix.s.QfW:J|
+| a0 af 3f d4 |..?. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #325 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 28 47 a5 7d 55 14 1d 44 b0 d8 8d 22 ab ba eb 1c |(G.}U..D..."....|
+| ee bf 38 e9 7a 0f 34 77 84 b4 99 34 c3 1d 05 63 |..8.z.4w...4...c|
+| a7 21 ed a4 e1 56 cd 3b cb 8c fb 2d d8 f1 b5 de |.!...V.;...-....|
+| 73 64 19 b1 5b ca 34 99 a9 ab 86 00 f3 23 cd a0 |sd..[.4......#..|
+| e4 45 a0 b8 8c b3 0e 7d 69 05 68 d8 d5 1b 64 d9 |.E.....}i.h...d.|
+| 63 c5 7d 54 51 53 bb 83 dd 36 bf f5 57 2e 85 61 |c.}TQS...6..W..a|
+| 99 ae e4 e1 2a a3 aa 09 65 25 7c 1f 50 23 18 90 |....*...e%|.P#..|
+Plaintext[112]:
+| d9 ee 12 35 a0 ad 73 90 9e 10 76 00 23 f4 aa df |...5..s...v.#...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a ca ac |yn.nl:4470......|
+| 2c bd 84 d9 c2 3d be 01 a9 83 46 8a c6 31 31 82 |,....=....F..11.|
+| 50 5c 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |P\..............|
+ssl_decrypt_record found padding 13 final len 98
+checking mac (len 62, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 81 a7 d8 33 49 c1 fd 2a 37 9c 66 35 31 ad 82 bb |...3I..*7.f51...|
+| 32 f2 97 59 |2..Y |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47266 found (nil)
+association_find: TCP port 4470 found 0x36d5030
+
+dissect_ssl enter frame #326 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fe 9c e3 de e1 e1 2a e2 ed 88 79 26 37 c9 96 28 |......*...y&7..(|
+| 85 ba 03 85 1a b4 2d 0f a2 d1 11 43 c9 d8 85 12 |......-....C....|
+| d7 27 3a be 63 62 17 89 2b d6 50 9b 7b 8f 4b 38 |.':.cb..+.P.{.K8|
+| 05 7f 03 68 cf 27 81 e7 d7 4f 55 51 a4 87 e0 74 |...h.'...OUQ...t|
+| 98 d3 25 91 c0 be 99 dd 4c 73 b1 4f 29 8c 2d f1 |..%.....Ls.O).-.|
+| 17 b2 86 de d9 91 ce eb bd 17 ba 92 c6 b0 64 5e |..............d^|
+| 7b 51 84 31 ac c4 bd cb 4d 7a 20 50 1b 8e 43 56 |{Q.1....Mz P..CV|
+| 7c 31 eb 73 af a1 ae 55 94 65 20 d2 d5 5a cf 50 ||1.s...U.e ..Z.P|
+| f7 2f cf 5b fd 90 47 94 05 89 62 b2 92 3f 29 0a |./.[..G...b..?).|
+| f8 1d 2e fd a0 33 0e 52 91 b8 07 10 1f c9 79 16 |.....3.R......y.|
+| 3b e6 cc 86 2c 17 45 00 dc c0 ba 57 79 6c 1c 1b |;...,.E....Wyl..|
+| 4c a9 a4 8f 93 b5 9e 27 19 72 b9 e7 1d ce d2 22 |L......'.r....."|
+| df 19 07 90 f1 fc 1d dc 86 fb f1 5c 65 c8 9a cb |...........\e...|
+| 30 ab 04 ce 94 62 b0 cd 90 72 0c 5e 3c b3 d5 3c |0....b...r.^<..<|
+| 08 8e 31 7b 50 a0 d0 ba 01 b2 c4 dc 2e 59 db c5 |..1{P........Y..|
+| ed b4 e2 f2 71 a5 ad ef b2 96 d3 13 04 4e 4e c1 |....q........NN.|
+| 3a f5 4d 1c 1a 5c 90 6c 02 c5 c7 d8 b6 02 58 92 |:.M..\.l......X.|
+| 13 39 aa 5a d8 20 ce f7 3c 44 5c 37 a4 38 c8 2c |.9.Z. ..<D\7.8.,|
+| 67 08 73 d5 c9 ee b0 2b 7f 20 e7 01 ca a6 0f 62 |g.s....+. .....b|
+| 37 6f 84 e4 50 ee 74 e7 7f 49 89 55 af cd 2e 56 |7o..P.t..I.U...V|
+| 1e 4d 41 c9 b5 07 e6 60 59 5d 24 f7 68 9a f8 8d |.MA....`Y]$.h...|
+| 9b 32 f2 2f 93 a2 62 df 53 82 ac 98 47 8e df 04 |.2./..b.S...G...|
+| 65 2f 60 d9 1b 61 08 71 fb 2d cc 6d 8f aa 2e 3e |e/`..a.q.-.m...>|
+| bf 88 45 47 62 88 46 2c 41 99 a6 40 10 76 b9 70 |..EGb.F,A..@.v.p|
+| 37 c7 c4 b9 3a 5c 66 22 e3 2a 30 1c 7d bb b6 e0 |7...:\f".*0.}...|
+Plaintext[400]:
+| 03 c2 ef 64 94 2b df 80 e6 b1 94 d9 a4 45 14 05 |...d.+.......E..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-|
+| 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 1f 01 4a 22 |nl'</script>..J"|
+| 46 99 bb 2d 6e 8b ff 3e 14 40 08 c1 96 e0 13 bc |F..-n..>.@......|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 07 f6 6d e0 75 b2 b0 29 a1 00 6b 05 82 44 82 |y..m.u..)..k..D.|
+| c6 ef 1a b4 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4470 found 0x36d5030
+
+dissect_ssl enter frame #327 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 08 8e 57 66 ec 81 3e 29 35 13 72 f0 3e 8c cb 23 |..Wf..>)5.r.>..#|
+| 05 67 15 60 45 70 df f4 1f af 15 62 07 39 b2 d1 |.g.`Ep.....b.9..|
+| d1 4c 1e 19 58 61 c1 a3 45 a4 6b 70 a0 d9 a3 cf |.L..Xa..E.kp....|
+Plaintext[48]:
+| fb 22 03 cb 07 46 47 4b 78 b7 53 7f de 5a 90 f6 |."...FGKx.S..Z..|
+| 01 00 1f 89 54 ef bc b7 41 de 4b 85 43 5a 9a 97 |....T...A.K.CZ..|
+| ee 4b d7 b4 5f 09 09 09 09 09 09 09 09 09 09 09 |.K.._...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1f 89 54 ef bc b7 41 de 4b 85 43 5a 9a 97 ee 4b |..T...A.K.CZ...K|
+| d7 b4 5f 09 |.._. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #329 (first time)
+ conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 0b 6d 3b f0 9c b0 ca 76 dc ce c5 66 ba 4c 68 72 |.m;....v...f.Lhr|
+| 9e 76 aa e7 1e b1 a7 58 38 79 46 88 42 5b a2 ad |.v.....X8yF.B[..|
+| 3d 5e b9 fd 7d 7e 5f f7 c4 f1 cf 15 ab 22 98 c1 |=^..}~_......"..|
+Plaintext[48]:
+| d1 d9 15 71 64 f8 c8 b6 5d eb 51 87 1a 59 25 94 |...qd...].Q..Y%.|
+| 01 00 56 7e 37 9a aa 5b dd 26 4c bf 6f 85 15 2c |..V~7..[.&L.o..,|
+| d4 4c 54 11 cf 72 09 09 09 09 09 09 09 09 09 09 |.LT..r..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 56 7e 37 9a aa 5b dd 26 4c bf 6f 85 15 2c d4 4c |V~7..[.&L.o..,.L|
+| 54 11 cf 72 |T..r |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #334 (first time)
+ssl_session_init: initializing ptr 0x7fca45bf9e60 size 688
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60559 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4471
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #336 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 a3 38 e2 e5 74 ed de 13 cd 97 3b 3e 3b 53 ee |..8..t.....;>;S.|
+| 76 fa 23 ae 64 7c e6 07 b9 ed 3a 69 1e dd 60 fa |v.#.d|....:i..`.|
+| e4 00 b8 76 72 9b 99 e2 aa bc ec 18 8a 72 b9 60 |...vr........r.`|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 1b 07 65 b7 ce 7a 5b d6 35 02 bc c7 9e 63 d2 |...e..z[.5....c.|
+| e5 3e 6c 7b a8 86 d2 a6 d6 21 b4 29 d3 52 34 c2 |.>l{.....!.).R4.|
+| f2 88 8c 7e 15 b7 d5 82 7f d7 5d b4 f7 b7 a1 c4 |...~......].....|
+| 50 be 4f 9f 14 45 76 07 e1 a2 6f ce 1a |P.O..Ev...o.. |
+hash out[104]:
+| db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)|
+| 35 06 0c 68 28 62 21 ca b3 f3 23 20 d4 30 9f 73 |5..h(b!...# .0.s|
+| 1e c4 f1 85 29 47 c6 1f 8a 4f 58 f6 9c 9a 7a 57 |....)G...OX...zW|
+| 84 98 22 64 fe 05 8f 55 f2 78 6b 99 94 7c ff 18 |.."d...U.xk..|..|
+| 27 6e 96 16 09 35 aa 01 98 c3 02 b4 63 b2 5f 02 |'n...5......c._.|
+| bd 8e 2f f1 ee b7 2c 5a 7a fd e8 a8 a5 75 d7 8a |../...,Zz....u..|
+| dc a5 70 03 33 ba 51 d0 |..p.3.Q. |
+PRF out[104]:
+| db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)|
+| 35 06 0c 68 28 62 21 ca b3 f3 23 20 d4 30 9f 73 |5..h(b!...# .0.s|
+| 1e c4 f1 85 29 47 c6 1f 8a 4f 58 f6 9c 9a 7a 57 |....)G...OX...zW|
+| 84 98 22 64 fe 05 8f 55 f2 78 6b 99 94 7c ff 18 |.."d...U.xk..|..|
+| 27 6e 96 16 09 35 aa 01 98 c3 02 b4 63 b2 5f 02 |'n...5......c._.|
+| bd 8e 2f f1 ee b7 2c 5a 7a fd e8 a8 a5 75 d7 8a |../...,Zz....u..|
+| dc a5 70 03 33 ba 51 d0 |..p.3.Q. |
+key expansion[104]:
+| db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)|
+| 35 06 0c 68 28 62 21 ca b3 f3 23 20 d4 30 9f 73 |5..h(b!...# .0.s|
+| 1e c4 f1 85 29 47 c6 1f 8a 4f 58 f6 9c 9a 7a 57 |....)G...OX...zW|
+| 84 98 22 64 fe 05 8f 55 f2 78 6b 99 94 7c ff 18 |.."d...U.xk..|..|
+| 27 6e 96 16 09 35 aa 01 98 c3 02 b4 63 b2 5f 02 |'n...5......c._.|
+| bd 8e 2f f1 ee b7 2c 5a 7a fd e8 a8 a5 75 d7 8a |../...,Zz....u..|
+| dc a5 70 03 33 ba 51 d0 |..p.3.Q. |
+Client MAC key[20]:
+| db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)|
+| 35 06 0c 68 |5..h |
+Server MAC key[20]:
+| 28 62 21 ca b3 f3 23 20 d4 30 9f 73 1e c4 f1 85 |(b!...# .0.s....|
+| 29 47 c6 1f |)G.. |
+Client Write key[16]:
+| 8a 4f 58 f6 9c 9a 7a 57 84 98 22 64 fe 05 8f 55 |.OX...zW.."d...U|
+Server Write key[16]:
+| f2 78 6b 99 94 7c ff 18 27 6e 96 16 09 35 aa 01 |.xk..|..'n...5..|
+Client Write IV[16]:
+| 98 c3 02 b4 63 b2 5f 02 bd 8e 2f f1 ee b7 2c 5a |....c._.../...,Z|
+Server Write IV[16]:
+| 7a fd e8 a8 a5 75 d7 8a dc a5 70 03 33 ba 51 d0 |z....u....p.3.Q.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #338 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14...
+looking for RSA pre-master008046a21c181ea8c86e56333a1c8bf54f34ccf9d6c666ba...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| de 2f 09 45 ce f2 8d 0d fe 5c 2d ea b3 42 55 c7 |./.E.....\-..BU.|
+| 49 cb c4 b1 1d 1a 22 4f 6f e6 8e 17 f3 e6 11 6d |I....."Oo......m|
+| 2a 63 62 12 af 71 53 26 ca 7a 7f 96 25 1d 29 d8 |*cb..qS&.z..%.).|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 1b 07 65 b7 ce 7a 5b d6 35 02 bc c7 9e 63 d2 |...e..z[.5....c.|
+| e5 3e 6c 7b a8 86 d2 a6 d6 21 b4 29 d3 52 34 c2 |.>l{.....!.).R4.|
+| f2 88 8c 7e 15 b7 d5 82 7f d7 5d b4 f7 b7 a1 c4 |...~......].....|
+| 50 be 4f 9f 14 45 76 07 e1 a2 6f ce 1a |P.O..Ev...o.. |
+hash out[104]:
+| 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..|
+| 18 c2 a3 64 c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 |...d......T.s./f|
+| dc 07 da a4 35 54 98 0f 12 b7 e5 a7 02 d7 92 c5 |....5T..........|
+| 4e 00 b7 07 f1 da 6a 21 d5 be d0 cb 0d 70 1f fb |N.....j!.....p..|
+| 77 d5 25 74 1f 37 f2 3a b3 88 d5 f8 60 1b fc a4 |w.%t.7.:....`...|
+| e1 48 8b db 94 3d c8 cb a9 d1 c7 dc ee 18 0c 95 |.H...=..........|
+| 8f 22 11 72 2e b0 23 51 |.".r..#Q |
+PRF out[104]:
+| 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..|
+| 18 c2 a3 64 c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 |...d......T.s./f|
+| dc 07 da a4 35 54 98 0f 12 b7 e5 a7 02 d7 92 c5 |....5T..........|
+| 4e 00 b7 07 f1 da 6a 21 d5 be d0 cb 0d 70 1f fb |N.....j!.....p..|
+| 77 d5 25 74 1f 37 f2 3a b3 88 d5 f8 60 1b fc a4 |w.%t.7.:....`...|
+| e1 48 8b db 94 3d c8 cb a9 d1 c7 dc ee 18 0c 95 |.H...=..........|
+| 8f 22 11 72 2e b0 23 51 |.".r..#Q |
+key expansion[104]:
+| 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..|
+| 18 c2 a3 64 c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 |...d......T.s./f|
+| dc 07 da a4 35 54 98 0f 12 b7 e5 a7 02 d7 92 c5 |....5T..........|
+| 4e 00 b7 07 f1 da 6a 21 d5 be d0 cb 0d 70 1f fb |N.....j!.....p..|
+| 77 d5 25 74 1f 37 f2 3a b3 88 d5 f8 60 1b fc a4 |w.%t.7.:....`...|
+| e1 48 8b db 94 3d c8 cb a9 d1 c7 dc ee 18 0c 95 |.H...=..........|
+| 8f 22 11 72 2e b0 23 51 |.".r..#Q |
+Client MAC key[20]:
+| 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..|
+| 18 c2 a3 64 |...d |
+Server MAC key[20]:
+| c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 dc 07 da a4 |......T.s./f....|
+| 35 54 98 0f |5T.. |
+Client Write key[16]:
+| 12 b7 e5 a7 02 d7 92 c5 4e 00 b7 07 f1 da 6a 21 |........N.....j!|
+Server Write key[16]:
+| d5 be d0 cb 0d 70 1f fb 77 d5 25 74 1f 37 f2 3a |.....p..w.%t.7.:|
+Client Write IV[16]:
+| b3 88 d5 f8 60 1b fc a4 e1 48 8b db 94 3d c8 cb |....`....H...=..|
+Server Write IV[16]:
+| a9 d1 c7 dc ee 18 0c 95 8f 22 11 72 2e b0 23 51 |.........".r..#Q|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| de 2f 09 45 ce f2 8d 0d fe 5c 2d ea b3 42 55 c7 |./.E.....\-..BU.|
+| 49 cb c4 b1 1d 1a 22 4f 6f e6 8e 17 f3 e6 11 6d |I....."Oo......m|
+| 2a 63 62 12 af 71 53 26 ca 7a 7f 96 25 1d 29 d8 |*cb..qS&.z..%.).|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 41 bd b8 88 a4 55 7b b8 d7 3d 0e 59 ff 76 db b9 |A....U{..=.Y.v..|
+| ee e6 3b 8f e0 04 f9 22 d9 d4 51 78 08 d7 6a 9f |..;...."..Qx..j.|
+| 05 89 04 2b 49 62 9b d1 4f 83 a8 29 6e 27 37 98 |...+Ib..O..)n'7.|
+| df 4e 5f 98 a6 a9 8f 44 0e 53 e3 11 3c ec 6f 93 |.N_....D.S..<.o.|
+Plaintext[64]:
+| 43 55 44 4a e3 d5 bc c6 9c 06 f7 19 c5 5f 57 b8 |CUDJ........._W.|
+| 14 00 00 0c 3e 6d ab 03 d5 ff ef a7 83 90 24 5f |....>m........$_|
+| d3 42 b5 01 7f ba ce 48 db 14 bb 29 6b 8b fd 51 |.B.....H...)k..Q|
+| cd f6 2d d0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..-.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d3 42 b5 01 7f ba ce 48 db 14 bb 29 6b 8b fd 51 |.B.....H...)k..Q|
+| cd f6 2d d0 |..-. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #339 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 80 4c 5a f0 49 79 18 61 de bb d6 fd 6e 0b 01 f4 |.LZ.Iy.a....n...|
+| 91 5a 4e ec c6 ef 6b 29 89 52 0c 34 3c d2 c8 ce |.ZN...k).R.4<...|
+| b7 6d ac d5 50 80 68 ab d8 28 f9 ce 4e 05 64 21 |.m..P.h..(..N.d!|
+| 22 52 6c 46 49 73 c2 2d 9c c7 77 0f 5a 4c e8 5f |"RlFIs.-..w.ZL._|
+Plaintext[64]:
+| c0 b6 c6 0f 96 da 17 a1 23 6f 86 47 81 66 2d 7e |........#o.G.f-~|
+| 14 00 00 0c cb 9d 89 4c 95 f1 e1 10 7f 87 90 7a |.......L.......z|
+| e4 5f bd d5 5b 97 a4 e6 81 21 c9 4d 23 b3 50 c5 |._..[....!.M#.P.|
+| ee 92 da a0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e4 5f bd d5 5b 97 a4 e6 81 21 c9 4d 23 b3 50 c5 |._..[....!.M#.P.|
+| ee 92 da a0 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #340 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 61 fb 74 0e 71 31 c5 e5 6b 9f ae 99 9b 42 4f 1d |a.t.q1..k....BO.|
+| 5d d9 6b e3 5f 33 d0 ea 3b ff 47 30 fd f7 eb 5e |].k._3..;.G0...^|
+| 65 64 99 cf cf 11 71 e0 c8 99 7f 62 5a 1b 8b e9 |ed....q....bZ...|
+| fb e4 39 2b c7 51 b5 b4 62 1f 1f a9 c3 f6 dc 5f |..9+.Q..b......_|
+| 8a 58 0c 47 fd d5 6d 25 88 a1 48 28 55 97 c7 a1 |.X.G..m%..H(U...|
+| d2 72 af 3d 4c 1d 22 b7 7c 4a 06 0a b1 0a e2 1d |.r.=L.".|J......|
+| b2 9d 9a aa 05 11 33 4a a0 77 d9 ce 77 a5 8e 8d |......3J.w..w...|
+Plaintext[112]:
+| 90 1a 3a 2c 6c 02 d6 89 8d 13 06 4f e4 9d 79 08 |..:,l......O..y.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 31 0d 0a 0d 0a c1 41 44 cc 60 bf 01 78 20 db |71.....AD.`..x .|
+| 65 6f 57 44 14 a3 aa 4a e3 6d 05 05 05 05 05 05 |eoWD...J.m......|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 f2 a4 e9 c8 fd 8a a5 27 9c f0 56 16 26 31 67 |........'..V.&1g|
+| 72 bb 3e 5e |r.>^ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60559 found (nil)
+association_find: TCP port 4471 found 0x36d50c0
+
+dissect_ssl enter frame #341 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 46 e2 1e b5 f4 d9 b9 d1 3e 25 05 68 f6 ec 0c 81 |F.......>%.h....|
+| 3f bc 19 4d b2 b7 38 d1 e7 ab b5 59 34 0d f3 35 |?..M..8....Y4..5|
+| 44 e0 d4 24 a6 dd c0 8e e7 81 6b c9 6a 5f d0 19 |D..$......k.j_..|
+| bd d8 91 33 fe 9f 11 f1 e7 df 5c 29 5f 14 93 e0 |...3......\)_...|
+| 7e 4b 3d c0 b1 0f 20 77 17 4b b1 c8 d0 90 38 33 |~K=... w.K....83|
+| 9c 7c 18 1a 18 c7 6d e7 f4 36 6c 92 98 d1 89 ed |.|....m..6l.....|
+| 9e e5 55 c8 01 04 06 76 c9 21 fb 48 3b 69 3c 32 |..U....v.!.H;i<2|
+| 13 b7 7e a9 90 20 25 72 a3 77 ba dc cc b8 80 db |..~.. %r.w......|
+| 56 1c c5 33 a8 98 fe 93 b7 48 9c ca ea 30 6f 62 |V..3.....H...0ob|
+| 21 a4 99 d3 29 dc 2b 32 0a 2e 3d c4 27 33 33 a3 |!...).+2..=.'33.|
+| 63 82 46 43 90 5e 4c 5d e0 69 9c 4a 57 22 a8 a3 |c.FC.^L].i.JW"..|
+| ab 48 c2 82 b6 33 17 f9 35 01 b7 a1 87 32 78 40 |.H...3..5....2x@|
+| 22 49 af c9 75 47 72 3c 9d 12 1b e9 6f a5 b1 92 |"I..uGr<....o...|
+| 4f 7a 6a 73 d9 9a 13 33 e0 57 48 b9 ec c8 a7 24 |Ozjs...3.WH....$|
+| 80 42 e3 f9 a2 6a 36 67 62 c9 eb 79 6d 2e 1e 51 |.B...j6gb..ym..Q|
+| cc f4 d9 3a e8 12 05 dd 4d 00 a8 b2 2c 81 fa bb |...:....M...,...|
+| 15 fd 88 c6 ae f4 65 7f b2 92 34 16 7a cb c9 e9 |......e...4.z...|
+| 27 e4 91 3b 0a 97 34 0c 2c f6 80 de 44 80 54 ab |'..;..4.,...D.T.|
+| 40 d5 1a 80 95 93 7e 69 4d 74 0a ba ec b8 c2 c6 |@.....~iMt......|
+| 2b cd bf 25 9b c8 8a 75 80 5e 90 cb 9a a1 8f 4f |+..%...u.^.....O|
+| 5e 29 80 40 b1 5c 52 37 41 ed 85 75 e9 77 db 42 |^).@.\R7A..u.w.B|
+| 69 2d a9 28 b5 ff 37 07 4b 46 77 24 b1 e5 9d 25 |i-.(..7.KFw$...%|
+| 06 0f 38 9d 7d 63 6e 9a a4 8d 32 02 7b 26 c3 5a |..8.}cn...2.{&.Z|
+| 26 08 5e 3e 0b d8 eb a8 b3 b9 ea ab 79 46 1d 13 |&.^>........yF..|
+| f4 40 70 8d c5 97 dd fc f7 c2 ce 47 31 01 bd d1 |.@p........G1...|
+Plaintext[400]:
+| 17 a8 63 57 41 2c 45 32 12 e5 da 02 12 32 b3 90 |..cWA,E2.....2..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D|
+| 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 63 c3 6c 77 |nl'</script>c.lw|
+| 2c 00 7a 6c 72 52 57 e5 3d db ef 45 11 ca 41 b6 |,.zlrRW.=..E..A.|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5a 71 32 5c fd 30 c4 fa 96 33 88 15 6a d4 da 52 |Zq2\.0...3..j..R|
+| 08 37 45 81 |.7E. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4471 found 0x36d50c0
+
+dissect_ssl enter frame #342 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 65 05 15 b8 2e 1b cf 96 91 85 bd 89 68 4c fa e8 |e...........hL..|
+| ab cd 49 98 89 19 f4 37 c8 b5 2a a3 8e ca 2f e8 |..I....7..*.../.|
+| 34 e7 ee c9 d5 15 29 2c c6 c0 3e 44 b3 d8 12 2f |4.....),..>D.../|
+Plaintext[48]:
+| 47 4d 74 6a 8b d6 2c da b6 d4 26 5a ca 0e d1 e2 |GMtj..,...&Z....|
+| 01 00 30 7f 3f dd 2f 80 0c 3a 34 f2 f9 55 c2 8e |..0.?./..:4..U..|
+| bc 35 24 50 f1 0b 09 09 09 09 09 09 09 09 09 09 |.5$P............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 30 7f 3f dd 2f 80 0c 3a 34 f2 f9 55 c2 8e bc 35 |0.?./..:4..U...5|
+| 24 50 f1 0b |$P.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #344 (first time)
+ conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e7 53 f5 34 2b 53 20 2e bc ba 70 61 9c 77 b6 e0 |.S.4+S ...pa.w..|
+| 6d 8d ff 0d 76 38 c1 33 4a 6d b3 11 fa 95 68 96 |m...v8.3Jm....h.|
+| f9 80 fc e8 f6 cf 5b 03 6c f0 b6 a7 5b 97 bf 2b |......[.l...[..+|
+Plaintext[48]:
+| 74 fa be 02 92 93 12 80 3a bb 09 43 71 25 ca cd |t.......:..Cq%..|
+| 01 00 e8 7a 80 0e 44 60 5e 50 f5 8a d9 b7 51 5d |...z..D`^P....Q]|
+| 0b 50 05 a0 cd be 09 09 09 09 09 09 09 09 09 09 |.P..............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e8 7a 80 0e 44 60 5e 50 f5 8a d9 b7 51 5d 0b 50 |.z..D`^P....Q].P|
+| 05 a0 cd be |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #349 (first time)
+ssl_session_init: initializing ptr 0x7fca45bfc3a0 size 688
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34738 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4472
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #351 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| de 2f 09 45 ce f2 8d 0d fe 5c 2d ea b3 42 55 c7 |./.E.....\-..BU.|
+| 49 cb c4 b1 1d 1a 22 4f 6f e6 8e 17 f3 e6 11 6d |I....."Oo......m|
+| 2a 63 62 12 af 71 53 26 ca 7a 7f 96 25 1d 29 d8 |*cb..qS&.z..%.).|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 2f 61 6d 5f 9a d8 f4 8c 36 41 0b 08 fc f8 72 |./am_....6A....r|
+| f0 c9 2f be 02 b4 c3 c8 6a 91 25 25 74 52 34 c2 |../.....j.%%tR4.|
+| f2 d9 89 53 4d e7 83 9f c5 46 1d fb 92 90 26 6a |...SM....F....&j|
+| 33 b0 f2 41 fa f9 3f 4c 98 4d 16 56 a8 |3..A..?L.M.V. |
+hash out[104]:
+| 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.|
+| a5 be 04 f0 8a 3f 4b 90 af c8 78 27 af 07 9a 04 |.....?K...x'....|
+| 70 f7 b3 f3 d1 ca 12 a9 d0 74 7e db 74 8a 2c 2b |p........t~.t.,+|
+| 44 be 18 51 a8 ec f8 1c d6 21 f1 03 b5 9b 3f 7e |D..Q.....!....?~|
+| 80 38 77 f9 22 96 1a ef a4 04 a5 e5 e7 1e 4b 8f |.8w.".........K.|
+| 5d 60 6a 5a b3 89 94 98 ba d2 21 a0 6c c3 d4 fa |]`jZ......!.l...|
+| 06 c3 5b d3 02 40 ab f0 |..[..@.. |
+PRF out[104]:
+| 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.|
+| a5 be 04 f0 8a 3f 4b 90 af c8 78 27 af 07 9a 04 |.....?K...x'....|
+| 70 f7 b3 f3 d1 ca 12 a9 d0 74 7e db 74 8a 2c 2b |p........t~.t.,+|
+| 44 be 18 51 a8 ec f8 1c d6 21 f1 03 b5 9b 3f 7e |D..Q.....!....?~|
+| 80 38 77 f9 22 96 1a ef a4 04 a5 e5 e7 1e 4b 8f |.8w.".........K.|
+| 5d 60 6a 5a b3 89 94 98 ba d2 21 a0 6c c3 d4 fa |]`jZ......!.l...|
+| 06 c3 5b d3 02 40 ab f0 |..[..@.. |
+key expansion[104]:
+| 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.|
+| a5 be 04 f0 8a 3f 4b 90 af c8 78 27 af 07 9a 04 |.....?K...x'....|
+| 70 f7 b3 f3 d1 ca 12 a9 d0 74 7e db 74 8a 2c 2b |p........t~.t.,+|
+| 44 be 18 51 a8 ec f8 1c d6 21 f1 03 b5 9b 3f 7e |D..Q.....!....?~|
+| 80 38 77 f9 22 96 1a ef a4 04 a5 e5 e7 1e 4b 8f |.8w.".........K.|
+| 5d 60 6a 5a b3 89 94 98 ba d2 21 a0 6c c3 d4 fa |]`jZ......!.l...|
+| 06 c3 5b d3 02 40 ab f0 |..[..@.. |
+Client MAC key[20]:
+| 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.|
+| a5 be 04 f0 |.... |
+Server MAC key[20]:
+| 8a 3f 4b 90 af c8 78 27 af 07 9a 04 70 f7 b3 f3 |.?K...x'....p...|
+| d1 ca 12 a9 |.... |
+Client Write key[16]:
+| d0 74 7e db 74 8a 2c 2b 44 be 18 51 a8 ec f8 1c |.t~.t.,+D..Q....|
+Server Write key[16]:
+| d6 21 f1 03 b5 9b 3f 7e 80 38 77 f9 22 96 1a ef |.!....?~.8w."...|
+Client Write IV[16]:
+| a4 04 a5 e5 e7 1e 4b 8f 5d 60 6a 5a b3 89 94 98 |......K.]`jZ....|
+Server Write IV[16]:
+| ba d2 21 a0 6c c3 d4 fa 06 c3 5b d3 02 40 ab f0 |..!.l.....[..@..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #353 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241fa...
+looking for RSA pre-master00809bc16b22c1a46bc3992feb94dc811ba939653b734155...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| db e5 52 01 d3 1d 01 f8 98 61 38 43 43 fd 02 1c |..R......a8CC...|
+| 8e c9 79 ec 9b 6c 78 c1 d9 79 83 06 01 40 04 e4 |..y..lx..y...@..|
+| 8b d9 84 66 6e 2b 4b 4d 26 a8 9d cc 79 31 f1 64 |...fn+KM&...y1.d|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f2 2f 61 6d 5f 9a d8 f4 8c 36 41 0b 08 fc f8 72 |./am_....6A....r|
+| f0 c9 2f be 02 b4 c3 c8 6a 91 25 25 74 52 34 c2 |../.....j.%%tR4.|
+| f2 d9 89 53 4d e7 83 9f c5 46 1d fb 92 90 26 6a |...SM....F....&j|
+| 33 b0 f2 41 fa f9 3f 4c 98 4d 16 56 a8 |3..A..?L.M.V. |
+hash out[104]:
+| e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...|
+| bf b3 28 27 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f |..('qZn...1...i.|
+| 3d e9 1a f5 f7 67 e8 1e 8a 91 e2 d3 e8 4b 5c c7 |=....g.......K\.|
+| f9 c7 95 d4 4d 11 18 b6 1e ba 87 66 19 38 72 d1 |....M......f.8r.|
+| 74 14 e5 8e 12 0b 79 d8 d3 6a a5 ee ec 04 de 19 |t.....y..j......|
+| 29 cd 9d a4 4c 7f d1 58 81 49 c9 77 53 25 61 64 |)...L..X.I.wS%ad|
+| 4e 79 09 d0 f1 c1 aa bc |Ny...... |
+PRF out[104]:
+| e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...|
+| bf b3 28 27 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f |..('qZn...1...i.|
+| 3d e9 1a f5 f7 67 e8 1e 8a 91 e2 d3 e8 4b 5c c7 |=....g.......K\.|
+| f9 c7 95 d4 4d 11 18 b6 1e ba 87 66 19 38 72 d1 |....M......f.8r.|
+| 74 14 e5 8e 12 0b 79 d8 d3 6a a5 ee ec 04 de 19 |t.....y..j......|
+| 29 cd 9d a4 4c 7f d1 58 81 49 c9 77 53 25 61 64 |)...L..X.I.wS%ad|
+| 4e 79 09 d0 f1 c1 aa bc |Ny...... |
+key expansion[104]:
+| e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...|
+| bf b3 28 27 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f |..('qZn...1...i.|
+| 3d e9 1a f5 f7 67 e8 1e 8a 91 e2 d3 e8 4b 5c c7 |=....g.......K\.|
+| f9 c7 95 d4 4d 11 18 b6 1e ba 87 66 19 38 72 d1 |....M......f.8r.|
+| 74 14 e5 8e 12 0b 79 d8 d3 6a a5 ee ec 04 de 19 |t.....y..j......|
+| 29 cd 9d a4 4c 7f d1 58 81 49 c9 77 53 25 61 64 |)...L..X.I.wS%ad|
+| 4e 79 09 d0 f1 c1 aa bc |Ny...... |
+Client MAC key[20]:
+| e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...|
+| bf b3 28 27 |..(' |
+Server MAC key[20]:
+| 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f 3d e9 1a f5 |qZn...1...i.=...|
+| f7 67 e8 1e |.g.. |
+Client Write key[16]:
+| 8a 91 e2 d3 e8 4b 5c c7 f9 c7 95 d4 4d 11 18 b6 |.....K\.....M...|
+Server Write key[16]:
+| 1e ba 87 66 19 38 72 d1 74 14 e5 8e 12 0b 79 d8 |...f.8r.t.....y.|
+Client Write IV[16]:
+| d3 6a a5 ee ec 04 de 19 29 cd 9d a4 4c 7f d1 58 |.j......)...L..X|
+Server Write IV[16]:
+| 81 49 c9 77 53 25 61 64 4e 79 09 d0 f1 c1 aa bc |.I.wS%adNy......|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| db e5 52 01 d3 1d 01 f8 98 61 38 43 43 fd 02 1c |..R......a8CC...|
+| 8e c9 79 ec 9b 6c 78 c1 d9 79 83 06 01 40 04 e4 |..y..lx..y...@..|
+| 8b d9 84 66 6e 2b 4b 4d 26 a8 9d cc 79 31 f1 64 |...fn+KM&...y1.d|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1e 3a 7f 8a 2b 9c 50 da 9b bd b2 57 49 f2 69 5b |.:..+.P....WI.i[|
+| a5 48 0b 7d 79 07 7f c9 44 7d b9 4b 18 ec d5 d7 |.H.}y...D}.K....|
+| 74 64 54 a4 b2 ee 5f 9b 18 88 77 6a 11 41 fa 14 |tdT..._...wj.A..|
+| d2 05 30 45 1d 07 dd 8b a1 7e 06 c5 84 8c ed 8c |..0E.....~......|
+Plaintext[64]:
+| 1e 51 95 94 b8 61 e0 52 41 d4 bf e8 ae 29 8a 98 |.Q...a.RA....)..|
+| 14 00 00 0c f6 ba 5c 76 4b 7b 4f 08 8e 35 9a 4a |......\vK{O..5.J|
+| 0c ca 2d ef d6 f6 1f 8c 0c fd 90 78 e0 8e a1 8b |..-........x....|
+| 83 3c e9 54 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.<.T............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0c ca 2d ef d6 f6 1f 8c 0c fd 90 78 e0 8e a1 8b |..-........x....|
+| 83 3c e9 54 |.<.T |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #354 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 68 16 16 28 af 99 24 4f 78 fe 45 f3 8f d4 07 8d |h..(..$Ox.E.....|
+| 78 c1 99 0f ae 9c 03 bc 32 e7 f1 6d 63 8c 48 1b |x.......2..mc.H.|
+| ca 4e c1 15 ef 9e c6 c4 17 86 b7 a9 bc 34 7d 63 |.N...........4}c|
+| 31 d8 d5 47 56 97 b8 15 e1 f8 d6 2a 81 23 e9 ed |1..GV......*.#..|
+Plaintext[64]:
+| b4 a6 76 0c de 27 16 58 11 f1 9f 38 74 3b 00 0f |..v..'.X...8t;..|
+| 14 00 00 0c e4 78 a3 2c f8 a9 4b d0 36 7f 01 79 |.....x.,..K.6..y|
+| fc 42 53 58 7e 12 17 9a 9e 73 17 f1 4a cc 85 09 |.BSX~....s..J...|
+| 90 92 50 73 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..Ps............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fc 42 53 58 7e 12 17 9a 9e 73 17 f1 4a cc 85 09 |.BSX~....s..J...|
+| 90 92 50 73 |..Ps |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #355 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a3 9d 3d 2b a0 c1 bb bf 08 c2 cc 14 9b fe 9b 0e |..=+............|
+| 1e 85 0a f1 5b 69 5e da 36 b8 b6 c7 18 34 cb 7f |....[i^.6....4..|
+| 45 e5 18 64 4e d4 b2 85 b9 fa d5 1b 68 d4 37 91 |E..dN.......h.7.|
+| 50 6a f5 f4 7b fb 52 dc da 3e a0 eb 35 1e 15 16 |Pj..{.R..>..5...|
+| 2c 05 39 b5 84 13 86 f0 ed 17 ce b6 b3 70 f0 6f |,.9..........p.o|
+| 04 05 bc 2f 82 31 67 fe cb d4 2f 42 f1 32 75 09 |.../.1g.../B.2u.|
+| dc ac eb 5c bd 3c 59 4e 7e 5e b9 d1 7e 20 d9 f2 |...\.<YN~^..~ ..|
+Plaintext[112]:
+| df f7 6f 7b 99 f4 e5 cf 9a 57 ad a8 22 0e 66 74 |..o{.....W..".ft|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 73 65 |Host: dhe-rsa-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 32 0d 0a 0d 0a 0d 14 b4 1a 26 9e 25 3a 40 13 |72........&.%:@.|
+| cf 22 f6 9f 0c b3 2d 0e 58 b1 05 05 05 05 05 05 |."....-.X.......|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 e8 15 c4 88 ab c1 cc e0 fd 31 8c 30 96 e2 8a |t.........1.0...|
+| 0c 1b 69 de |..i. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34738 found (nil)
+association_find: TCP port 4472 found 0x36d5150
+
+dissect_ssl enter frame #356 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 95 dc 3c 15 0d 6c 35 b0 f0 95 99 29 12 82 3c ce |..<..l5....)..<.|
+| eb 78 7d 27 f0 77 d1 6e 6e 22 60 8c 35 98 67 2e |.x}'.w.nn"`.5.g.|
+| 87 26 b2 ed 5d ef ba fc f9 8c 69 7e b9 e4 b2 96 |.&..].....i~....|
+| a4 7b b5 0e b8 0f b9 2a 3a 20 06 da b7 93 ce 4d |.{.....*: .....M|
+| 4c 0b d9 d3 77 0b 25 51 b5 9e 80 a0 f2 c7 fe fa |L...w.%Q........|
+| bd fd ff c1 ea 15 56 1a a9 8e 54 63 e3 29 89 46 |......V...Tc.).F|
+| 5c fb 29 bf 35 92 d5 7f 5e bb 54 7d e7 b1 49 d8 |\.).5...^.T}..I.|
+| d5 10 d1 ab 53 0a 3f 06 e7 8b 02 92 cc 4d b4 08 |....S.?......M..|
+| c6 b1 3e e1 a0 b0 77 20 10 ce 7b df 05 8e 30 a5 |..>...w ..{...0.|
+| 3c be 17 2e 32 b8 17 42 ee 01 d9 8e fc 39 42 41 |<...2..B.....9BA|
+| a3 0c 6b 08 bd 4d 1b f6 04 80 3c 2d 12 f4 f3 50 |..k..M....<-...P|
+| 3a 82 6d d0 1c 16 c7 6c 3b cd 73 dd 91 be 50 00 |:.m....l;.s...P.|
+| a9 27 39 83 59 aa d6 70 a3 13 8c be 4e ce 98 f2 |.'9.Y..p....N...|
+| 8c b6 00 4e d7 68 9a 32 2a 1d 15 85 73 c5 ae bc |...N.h.2*...s...|
+| b9 6d 6c 09 63 8a 4d cb 15 2a 82 a7 d1 0c 90 8d |.ml.c.M..*......|
+| 2f 1f 75 19 d0 78 7f 60 38 7e 94 53 68 38 6e cd |/.u..x.`8~.Sh8n.|
+| 23 72 59 68 ac 01 3d f7 2a 07 57 74 75 fc 9b 61 |#rYh..=.*.Wtu..a|
+| 98 75 f1 39 01 15 d5 ca db 16 e1 8e a3 76 00 8c |.u.9.........v..|
+| 64 f5 57 79 70 1c 58 e3 72 a8 d9 08 35 3a 1a a9 |d.Wyp.X.r...5:..|
+| 6a f9 0b 46 e6 65 1d 93 41 f7 69 77 59 ce 39 f5 |j..F.e..A.iwY.9.|
+| 7f 87 27 3b 2d 4c 60 56 bb 6c 9e 59 ea c5 d1 a3 |..';-L`V.l.Y....|
+| 98 b6 ab 41 e2 9a 85 1f 68 25 6d 8f 36 ae bc 34 |...A....h%m.6..4|
+| a7 5e 87 96 64 26 64 d9 37 e2 b4 5c 71 47 6f 94 |.^..d&d.7..\qGo.|
+| 9e 86 c4 db 12 21 c8 18 c6 56 45 0d 9a 68 ec 97 |.....!...VE..h..|
+| 6a 55 8e 1c 4c c9 71 52 fe 69 38 27 2f 74 e3 9b |jU..L.qR.i8'/t..|
+Plaintext[400]:
+| d6 8b b6 04 4c 26 95 02 7c 94 dc aa f5 78 c0 50 |....L&..|....x.P|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R|
+| 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 25 8b e8 ab |nl'</script>%...|
+| c2 30 30 03 29 9f 8e 5c f0 f3 1c 00 02 2d f4 cb |.00.)..\.....-..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 44 5a 8b c8 1d 1b a2 6c e5 17 48 85 de 6f 0e 1b |DZ.....l..H..o..|
+| b0 23 88 e1 |.#.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4472 found 0x36d5150
+
+dissect_ssl enter frame #357 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 84 53 b8 3b 44 f3 5b 2e cc 01 e0 2f 89 7c 0c 97 |.S.;D.[..../.|..|
+| 2c 37 4e cb 03 38 01 9c f3 60 f4 a2 12 18 5c c5 |,7N..8...`....\.|
+| 22 56 43 f7 79 a1 ed 25 42 5c a6 dc 86 28 48 dd |"VC.y..%B\...(H.|
+Plaintext[48]:
+| 63 c2 be 6e 7e a8 67 17 6b 79 be 51 29 a6 fb cc |c..n~.g.ky.Q)...|
+| 01 00 b0 29 6b 84 bb e1 e7 d9 29 bf a1 5b 5b d5 |...)k.....)..[[.|
+| 84 b8 c5 d7 3a 1a 09 09 09 09 09 09 09 09 09 09 |....:...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b0 29 6b 84 bb e1 e7 d9 29 bf a1 5b 5b d5 84 b8 |.)k.....)..[[...|
+| c5 d7 3a 1a |..:. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #359 (first time)
+ conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 50 95 a7 d4 94 b4 fa a6 ea 1e 3b d8 cc 91 a9 fb |P.........;.....|
+| 10 50 24 e9 02 4c a6 e0 cb 20 74 2e 7d 00 91 db |.P$..L... t.}...|
+| 5b 87 4d c1 32 a1 96 5c c4 ba db 14 48 ed c8 62 |[.M.2..\....H..b|
+Plaintext[48]:
+| c6 57 b1 66 75 06 89 de d7 cf f5 87 fa 9e 14 81 |.W.fu...........|
+| 01 00 fa a7 9c 29 9d af 9b 22 30 1a 42 6a d1 8b |.....)..."0.Bj..|
+| eb 81 76 03 d1 f1 09 09 09 09 09 09 09 09 09 09 |..v.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fa a7 9c 29 9d af 9b 22 30 1a 42 6a d1 8b eb 81 |...)..."0.Bj....|
+| 76 03 d1 f1 |v... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #364 (first time)
+ssl_session_init: initializing ptr 0x7fca45bfe8e0 size 688
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45655 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4480
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #366 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| db e5 52 01 d3 1d 01 f8 98 61 38 43 43 fd 02 1c |..R......a8CC...|
+| 8e c9 79 ec 9b 6c 78 c1 d9 79 83 06 01 40 04 e4 |..y..lx..y...@..|
+| 8b d9 84 66 6e 2b 4b 4d 26 a8 9d cc 79 31 f1 64 |...fn+KM&...y1.d|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 67 56 c6 2e e6 4b 45 cf 17 ca ef d0 cd 10 5e |.gV...KE.......^|
+| be 82 52 75 be c2 7a eb 52 0d 72 94 c9 52 34 c2 |..Ru..z.R.r..R4.|
+| f3 6a 2e 00 da ce d9 50 61 0a 27 8d f5 d5 cb cd |.j.....Pa.'.....|
+| 23 24 69 fe e9 bc 7a 06 51 1d a6 5e 98 |#$i...z.Q..^. |
+hash out[104]:
+| 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...|
+| 60 7b 90 de c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 |`{...M4...LA....|
+| 75 97 fb 60 d7 60 36 ba 02 a1 10 b3 36 20 12 8e |u..`.`6.....6 ..|
+| 9b c4 90 be c7 bc d2 49 40 87 52 c8 ca 8f af 8e |.......I@.R.....|
+| c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...|
+| f2 fd cf e8 7e eb 76 2e 8f 9c 5d bd 06 16 49 88 |....~.v...]...I.|
+| 8a db a3 26 90 9a 99 20 |...&... |
+PRF out[104]:
+| 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...|
+| 60 7b 90 de c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 |`{...M4...LA....|
+| 75 97 fb 60 d7 60 36 ba 02 a1 10 b3 36 20 12 8e |u..`.`6.....6 ..|
+| 9b c4 90 be c7 bc d2 49 40 87 52 c8 ca 8f af 8e |.......I@.R.....|
+| c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...|
+| f2 fd cf e8 7e eb 76 2e 8f 9c 5d bd 06 16 49 88 |....~.v...]...I.|
+| 8a db a3 26 90 9a 99 20 |...&... |
+key expansion[104]:
+| 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...|
+| 60 7b 90 de c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 |`{...M4...LA....|
+| 75 97 fb 60 d7 60 36 ba 02 a1 10 b3 36 20 12 8e |u..`.`6.....6 ..|
+| 9b c4 90 be c7 bc d2 49 40 87 52 c8 ca 8f af 8e |.......I@.R.....|
+| c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...|
+| f2 fd cf e8 7e eb 76 2e 8f 9c 5d bd 06 16 49 88 |....~.v...]...I.|
+| 8a db a3 26 90 9a 99 20 |...&... |
+Client MAC key[20]:
+| 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...|
+| 60 7b 90 de |`{.. |
+Server MAC key[20]:
+| c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 75 97 fb 60 |.M4...LA....u..`|
+| d7 60 36 ba |.`6. |
+Client Write key[24]:
+| 02 a1 10 b3 36 20 12 8e 9b c4 90 be c7 bc d2 49 |....6 .........I|
+| 40 87 52 c8 ca 8f af 8e |@.R..... |
+Server Write key[24]:
+| c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...|
+| f2 fd cf e8 7e eb 76 2e |....~.v. |
+Client Write IV[8]:
+| 8f 9c 5d bd 06 16 49 88 |..]...I. |
+Server Write IV[8]:
+| 8a db a3 26 90 9a 99 20 |...&... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #368 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 166
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9...
+looking for RSA pre-master6104636ee7ffcd33a0605110afc63fa7dcd80ce6929394cb...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 8d c6 6d a6 6e f1 ec ed ed 64 95 e3 cb dd 99 |...m.n....d.....|
+| 63 ba 87 8c 80 c4 a3 63 27 b5 2f 4d 81 10 d9 4c |c......c'./M...L|
+| 6b 41 4c 75 6c ab 14 92 59 8a f0 71 48 77 18 8f |kALul...Y..qHw..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 67 56 c6 2e e6 4b 45 cf 17 ca ef d0 cd 10 5e |.gV...KE.......^|
+| be 82 52 75 be c2 7a eb 52 0d 72 94 c9 52 34 c2 |..Ru..z.R.r..R4.|
+| f3 6a 2e 00 da ce d9 50 61 0a 27 8d f5 d5 cb cd |.j.....Pa.'.....|
+| 23 24 69 fe e9 bc 7a 06 51 1d a6 5e 98 |#$i...z.Q..^. |
+hash out[104]:
+| 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF|
+| 95 6b a7 37 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a |.k.7q....}.).9.j|
+| 9a aa 2e 40 0b 30 67 88 aa 22 06 30 82 86 86 f5 |...@.0g..".0....|
+| 72 a8 8a 3a 77 71 40 63 c8 94 3f a7 d1 20 e4 1a |r..:wq@c..?.. ..|
+| a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y|
+| 70 fc ac 1e 8c 18 bc c4 54 a1 90 88 16 4e 6d b2 |p.......T....Nm.|
+| d0 d9 69 c0 07 f7 b9 e5 |..i..... |
+PRF out[104]:
+| 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF|
+| 95 6b a7 37 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a |.k.7q....}.).9.j|
+| 9a aa 2e 40 0b 30 67 88 aa 22 06 30 82 86 86 f5 |...@.0g..".0....|
+| 72 a8 8a 3a 77 71 40 63 c8 94 3f a7 d1 20 e4 1a |r..:wq@c..?.. ..|
+| a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y|
+| 70 fc ac 1e 8c 18 bc c4 54 a1 90 88 16 4e 6d b2 |p.......T....Nm.|
+| d0 d9 69 c0 07 f7 b9 e5 |..i..... |
+key expansion[104]:
+| 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF|
+| 95 6b a7 37 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a |.k.7q....}.).9.j|
+| 9a aa 2e 40 0b 30 67 88 aa 22 06 30 82 86 86 f5 |...@.0g..".0....|
+| 72 a8 8a 3a 77 71 40 63 c8 94 3f a7 d1 20 e4 1a |r..:wq@c..?.. ..|
+| a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y|
+| 70 fc ac 1e 8c 18 bc c4 54 a1 90 88 16 4e 6d b2 |p.......T....Nm.|
+| d0 d9 69 c0 07 f7 b9 e5 |..i..... |
+Client MAC key[20]:
+| 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF|
+| 95 6b a7 37 |.k.7 |
+Server MAC key[20]:
+| 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a 9a aa 2e 40 |q....}.).9.j...@|
+| 0b 30 67 88 |.0g. |
+Client Write key[24]:
+| aa 22 06 30 82 86 86 f5 72 a8 8a 3a 77 71 40 63 |.".0....r..:wq@c|
+| c8 94 3f a7 d1 20 e4 1a |..?.. .. |
+Server Write key[24]:
+| a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y|
+| 70 fc ac 1e 8c 18 bc c4 |p....... |
+Client Write IV[8]:
+| 54 a1 90 88 16 4e 6d b2 |T....Nm. |
+Server Write IV[8]:
+| d0 d9 69 c0 07 f7 b9 e5 |..i..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 93 8d c6 6d a6 6e f1 ec ed ed 64 95 e3 cb dd 99 |...m.n....d.....|
+| 63 ba 87 8c 80 c4 a3 63 27 b5 2f 4d 81 10 d9 4c |c......c'./M...L|
+| 6b 41 4c 75 6c ab 14 92 59 8a f0 71 48 77 18 8f |kALul...Y..qHw..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| a3 93 b8 8a cf 6b e4 d9 33 0f 1c d3 1d 81 32 a6 |.....k..3.....2.|
+| 54 08 df 6d 00 30 76 60 fe f7 af 5c 9d 17 a9 ff |T..m.0v`...\....|
+| 19 a2 05 4c f3 54 da 64 c5 6b a9 e3 52 c7 7d e7 |...L.T.d.k..R.}.|
+Plaintext[48]:
+| fb 59 9c 9d 32 7e 8f bf 14 00 00 0c c2 43 98 64 |.Y..2~.......C.d|
+| 90 40 7c 77 81 0d d5 cd f2 90 7e 64 1e 54 a6 c2 |.@|w......~d.T..|
+| ea c8 44 d8 f0 6d 9e 3f 15 25 4f b2 03 03 03 03 |..D..m.?.%O.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f2 90 7e 64 1e 54 a6 c2 ea c8 44 d8 f0 6d 9e 3f |..~d.T....D..m.?|
+| 15 25 4f b2 |.%O. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #369 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f7 7d fb 97 0d 6a c0 91 a1 ff 30 7c 78 0d 92 e3 |.}...j....0|x...|
+| 9a 10 73 38 a1 e3 16 45 81 25 9d 40 25 f5 29 ef |..s8...E.%.@%.).|
+| 17 1f 36 74 ce 16 6c 93 de 38 6d 8d 7e c0 c6 3e |..6t..l..8m.~..>|
+Plaintext[48]:
+| 83 ab fa fb ec 69 9f 89 14 00 00 0c f1 d6 e1 58 |.....i.........X|
+| af 90 99 de 8a 17 38 3b e2 f2 8c 3c 1a 40 60 49 |......8;...<.@`I|
+| cf 2d ad 62 f8 1d c5 a1 29 3a 13 5b 03 03 03 03 |.-.b....):.[....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e2 f2 8c 3c 1a 40 60 49 cf 2d ad 62 f8 1d c5 a1 |...<.@`I.-.b....|
+| 29 3a 13 5b |):.[ |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #370 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| b6 61 93 c3 0e 9d 91 10 6a 81 70 e0 16 85 87 dd |.a......j.p.....|
+| be 81 c9 07 3c 68 d9 b6 8b 63 53 ae 5d 7f a8 cb |....<h...cS.]...|
+| 12 c1 71 24 fa b7 ad 27 08 08 70 45 44 d8 ed 3d |..q$...'..pED..=|
+| b4 b8 89 9c 35 e0 1e a1 7f 08 62 c6 69 07 df 98 |....5.....b.i...|
+| 12 ff b5 77 ec ac b6 7d a4 09 fd 1c e3 84 d1 79 |...w...}.......y|
+| 47 3c 4c 3f ca 49 86 19 b1 a4 a8 98 c2 13 be f0 |G<L?.I..........|
+| 0e 5d 57 10 d1 35 56 01 e0 29 38 52 5f 2a dd 9b |.]W..5V..)8R_*..|
+Plaintext[112]:
+| 3e 0a fe 21 66 e7 f0 c4 47 45 54 20 2f 20 48 54 |>..!f...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 63 |dh-ecdsa-des-cbc|
+| 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |3-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 38 |ekensteyn.nl:448|
+| 30 0d 0a 0d 0a a1 69 4a 2a 11 81 e8 55 39 a3 da |0.....iJ*...U9..|
+| db fb 37 aa 4f ec 4a 1c 00 06 06 06 06 06 06 06 |..7.O.J.........|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d3 7b 38 78 54 ad c4 33 70 1f 04 33 b2 18 2d d2 |.{8xT..3p..3..-.|
+| b0 5e 12 de |.^.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45655 found (nil)
+association_find: TCP port 4480 found 0x3737fd0
+
+dissect_ssl enter frame #371 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| fb c6 bf 07 05 1a 7f 3f ab b6 7e cf c1 b3 15 b5 |.......?..~.....|
+| dc 10 be d3 89 e4 60 c7 4b c6 9a 6b 46 cc 60 c9 |......`.K..kF.`.|
+| 65 6f 87 61 3a 0a b5 42 95 a9 d2 b3 de e3 b3 ff |eo.a:..B........|
+| 3a cd f7 bd 9a 03 84 95 f5 01 4b 45 38 54 8b 88 |:.........KE8T..|
+| 39 8e 90 3d fc f2 0e 44 12 42 71 7b c0 0f ff 62 |9..=...D.Bq{...b|
+| 70 0d e2 5d 96 c9 28 68 06 d1 c1 0a 9a e1 89 a6 |p..]..(h........|
+| 9f 8c 74 70 0c 6d e3 b4 ff 24 cf 10 8b bf cd f7 |..tp.m...$......|
+| 5f f0 18 36 a2 7f c7 61 d3 48 ce dc e5 06 c3 c6 |_..6...a.H......|
+| 2d f8 f9 7b 68 30 7b bc f5 4d 8f e2 3a f2 ff f6 |-..{h0{..M..:...|
+| 74 5c 37 16 fe b2 bc cb 0b ef 59 57 83 0d ab 06 |t\7.......YW....|
+| 56 e6 58 60 a2 23 85 80 b4 b5 72 a2 11 7e bf 62 |V.X`.#....r..~.b|
+| 1c 62 01 25 b2 f9 fa e7 1b 77 f5 86 48 b1 c1 f6 |.b.%.....w..H...|
+| a6 bc 04 9f a8 3b d0 6b 87 07 72 0e d4 91 4f d0 |.....;.k..r...O.|
+| f8 c8 33 08 c1 cc 8c e7 c8 48 03 6b 99 d4 ed 7a |..3......H.k...z|
+| 72 71 59 c6 63 f2 0f a9 40 6d 56 b8 64 81 77 60 |rqY.c...@mV.d.w`|
+| 2d 87 ca b7 26 da d1 c2 f5 63 ff fa f2 70 ec 4d |-...&....c...p.M|
+| c8 9d 3e 0e fc c3 90 a9 b5 c3 ce 32 39 ba 42 dc |..>........29.B.|
+| 7b 06 62 a2 7c c2 07 85 32 0a 74 24 83 15 77 89 |{.b.|...2.t$..w.|
+| 73 42 54 80 d2 61 5f 68 7f 24 69 f8 a2 9a 1d dd |sBT..a_h.$i.....|
+| 15 13 d1 86 65 bb 0b f5 6b 74 d4 59 b2 fd 5c 85 |....e...kt.Y..\.|
+| 07 ca 19 8c 97 77 2a d3 ec 3f 42 39 46 f5 49 a6 |.....w*..?B9F.I.|
+| 72 c6 65 c7 4b a1 bd 1c df b4 11 4f c9 62 d7 68 |r.e.K......O.b.h|
+| 61 cd 15 57 cf 49 79 35 db 62 12 72 5d a0 a2 b2 |a..W.Iy5.b.r]...|
+| 0c 0d 53 5b 2e d2 c7 ab 2e ec 00 22 fb 41 a1 36 |..S[.......".A.6|
+Plaintext[384]:
+| d0 57 7b 32 c1 22 2b c7 48 54 54 50 2f 31 2e 31 |.W{2."+.HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 33 31 20 47 4d |2013 20:11:31 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 33 |che....0xC0,0x03|
+| 20 2d 20 45 43 44 48 2d 45 43 44 53 41 2d 44 45 | - ECDH-ECDSA-DE|
+| 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 33 |S-CBC3-SHA SSLv3|
+| 20 4b 78 3d 45 43 44 48 2f 45 43 44 53 41 20 41 | Kx=ECDH/ECDSA A|
+| 75 3d 45 43 44 48 20 45 6e 63 3d 33 44 45 53 28 |u=ECDH Enc=3DES(|
+| 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1<sc|
+| 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f |ript>document.do|
+| 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'</s|
+| 63 72 69 70 74 3e a3 4d 89 a3 81 49 8d a4 f0 29 |cript>.M...I...)|
+| 9c aa c3 71 b8 80 26 c3 de 5f 05 05 05 05 05 05 |...q..&.._......|
+ssl_decrypt_record found padding 5 final len 378
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 21 8a 5d 30 a9 f4 80 8e 4d b8 04 44 d2 d6 7f 1e |!.]0....M..D....|
+| 7b 56 0f 22 |{V." |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4480 found 0x3737fd0
+
+dissect_ssl enter frame #372 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 27 4f 65 81 1a 6f 96 29 c3 c6 67 db 17 ea f4 b0 |'Oe..o.)..g.....|
+| ec cb ef 68 1e a2 ee 81 62 28 f9 68 3b 19 b9 89 |...h....b(.h;...|
+Plaintext[32]:
+| 4a 96 5d a6 d5 f1 e5 18 01 00 9e a6 22 54 7a d4 |J.]........."Tz.|
+| b9 06 c7 2e 9a 7a 83 6b ae 06 fa 19 dc 76 01 01 |.....z.k.....v..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9e a6 22 54 7a d4 b9 06 c7 2e 9a 7a 83 6b ae 06 |.."Tz......z.k..|
+| fa 19 dc 76 |...v |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #374 (first time)
+ conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 87 ab 98 10 ab f0 42 08 66 46 80 19 45 6d bc 31 |......B.fF..Em.1|
+| fa 65 23 e5 7b 84 00 df 0e d4 5c c3 38 0b 22 1f |.e#.{.....\.8.".|
+Plaintext[32]:
+| e6 d5 ae b8 3d 19 ae be 01 00 f2 8b 0b 10 44 4f |....=.........DO|
+| 87 02 7c 3a 76 18 6e 1d f9 9f e6 02 fc 99 01 01 |..|:v.n.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f2 8b 0b 10 44 4f 87 02 7c 3a 76 18 6e 1d f9 9f |....DO..|:v.n...|
+| e6 02 fc 99 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #379 (first time)
+ssl_session_init: initializing ptr 0x7fca45c00e00 size 688
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35376 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4481
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #381 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 8d c6 6d a6 6e f1 ec ed ed 64 95 e3 cb dd 99 |...m.n....d.....|
+| 63 ba 87 8c 80 c4 a3 63 27 b5 2f 4d 81 10 d9 4c |c......c'./M...L|
+| 6b 41 4c 75 6c ab 14 92 59 8a f0 71 48 77 18 8f |kALul...Y..qHw..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 6a 0b 87 04 21 3d 2d 34 b6 6f 11 93 45 cc 1d |.j...!=-4.o..E..|
+| 4b 0b 4c 95 a8 88 34 08 7a 19 cd 83 c1 52 34 c2 |K.L...4.z....R4.|
+| f3 7b 6b 51 87 ff b0 77 f0 15 a5 58 da 43 d7 22 |.{kQ...w...X.C."|
+| e1 56 02 ae 47 a7 fe 15 f0 5c f5 45 0c |.V..G....\.E. |
+hash out[104]:
+| 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.|
+| 26 52 e3 db 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe |&R..=.J...~d..V.|
+| 60 88 1f bd 61 46 a7 8b a9 76 19 ce 01 11 59 1a |`...aF...v....Y.|
+| 2d d0 5b 77 38 08 bf fc 17 46 e0 a4 ba 5d 46 72 |-.[w8....F...]Fr|
+| 55 94 20 cb 41 75 ee de e5 8e 71 7d 67 f4 6d 21 |U. .Au....q}g.m!|
+| 43 d7 58 f5 04 57 c6 f7 d7 a8 01 49 1f 8e 83 f6 |C.X..W.....I....|
+| fb c6 02 c5 20 80 6b 32 |.... .k2 |
+PRF out[104]:
+| 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.|
+| 26 52 e3 db 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe |&R..=.J...~d..V.|
+| 60 88 1f bd 61 46 a7 8b a9 76 19 ce 01 11 59 1a |`...aF...v....Y.|
+| 2d d0 5b 77 38 08 bf fc 17 46 e0 a4 ba 5d 46 72 |-.[w8....F...]Fr|
+| 55 94 20 cb 41 75 ee de e5 8e 71 7d 67 f4 6d 21 |U. .Au....q}g.m!|
+| 43 d7 58 f5 04 57 c6 f7 d7 a8 01 49 1f 8e 83 f6 |C.X..W.....I....|
+| fb c6 02 c5 20 80 6b 32 |.... .k2 |
+key expansion[104]:
+| 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.|
+| 26 52 e3 db 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe |&R..=.J...~d..V.|
+| 60 88 1f bd 61 46 a7 8b a9 76 19 ce 01 11 59 1a |`...aF...v....Y.|
+| 2d d0 5b 77 38 08 bf fc 17 46 e0 a4 ba 5d 46 72 |-.[w8....F...]Fr|
+| 55 94 20 cb 41 75 ee de e5 8e 71 7d 67 f4 6d 21 |U. .Au....q}g.m!|
+| 43 d7 58 f5 04 57 c6 f7 d7 a8 01 49 1f 8e 83 f6 |C.X..W.....I....|
+| fb c6 02 c5 20 80 6b 32 |.... .k2 |
+Client MAC key[20]:
+| 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.|
+| 26 52 e3 db |&R.. |
+Server MAC key[20]:
+| 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe 60 88 1f bd |=.J...~d..V.`...|
+| 61 46 a7 8b |aF.. |
+Client Write key[16]:
+| a9 76 19 ce 01 11 59 1a 2d d0 5b 77 38 08 bf fc |.v....Y.-.[w8...|
+Server Write key[16]:
+| 17 46 e0 a4 ba 5d 46 72 55 94 20 cb 41 75 ee de |.F...]FrU. .Au..|
+Client Write IV[16]:
+| e5 8e 71 7d 67 f4 6d 21 43 d7 58 f5 04 57 c6 f7 |..q}g.m!C.X..W..|
+Server Write IV[16]:
+| d7 a8 01 49 1f 8e 83 f6 fb c6 02 c5 20 80 6b 32 |...I........ .k2|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #383 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47...
+looking for RSA pre-master6104d4432640947655d2c1d09f94b58e44f58544c34d38e5...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 86 c4 12 44 4e 5f 67 a3 a8 d9 78 e6 98 0b 1e 5c |...DN_g...x....\|
+| 4a 22 d5 34 dd fd 05 04 7b ee e3 6b 27 a9 37 64 |J".4....{..k'.7d|
+| 23 33 26 11 a5 a7 f9 f6 09 eb 75 1b ee d8 0c 7f |#3&.......u.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 6a 0b 87 04 21 3d 2d 34 b6 6f 11 93 45 cc 1d |.j...!=-4.o..E..|
+| 4b 0b 4c 95 a8 88 34 08 7a 19 cd 83 c1 52 34 c2 |K.L...4.z....R4.|
+| f3 7b 6b 51 87 ff b0 77 f0 15 a5 58 da 43 d7 22 |.{kQ...w...X.C."|
+| e1 56 02 ae 47 a7 fe 15 f0 5c f5 45 0c |.V..G....\.E. |
+hash out[104]:
+| e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..|
+| 09 e9 9c bb 35 34 7d 77 eb 01 da 5d ac 66 fa 8e |....54}w...].f..|
+| b0 28 d9 1b 2e 55 0a ea 28 86 2c 89 f1 f7 56 57 |.(...U..(.,...VW|
+| 49 35 17 ec a5 f2 51 71 e2 f3 58 2e fc fb 7c 72 |I5....Qq..X...|r|
+| 97 ae 6c d2 2e 73 6d 53 70 4c 5a f4 a4 57 8c 28 |..l..smSpLZ..W.(|
+| 46 f4 44 1e 87 e7 73 05 e9 c3 a1 11 ea 79 15 f7 |F.D...s......y..|
+| af ed 9e ca 01 65 04 90 |.....e.. |
+PRF out[104]:
+| e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..|
+| 09 e9 9c bb 35 34 7d 77 eb 01 da 5d ac 66 fa 8e |....54}w...].f..|
+| b0 28 d9 1b 2e 55 0a ea 28 86 2c 89 f1 f7 56 57 |.(...U..(.,...VW|
+| 49 35 17 ec a5 f2 51 71 e2 f3 58 2e fc fb 7c 72 |I5....Qq..X...|r|
+| 97 ae 6c d2 2e 73 6d 53 70 4c 5a f4 a4 57 8c 28 |..l..smSpLZ..W.(|
+| 46 f4 44 1e 87 e7 73 05 e9 c3 a1 11 ea 79 15 f7 |F.D...s......y..|
+| af ed 9e ca 01 65 04 90 |.....e.. |
+key expansion[104]:
+| e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..|
+| 09 e9 9c bb 35 34 7d 77 eb 01 da 5d ac 66 fa 8e |....54}w...].f..|
+| b0 28 d9 1b 2e 55 0a ea 28 86 2c 89 f1 f7 56 57 |.(...U..(.,...VW|
+| 49 35 17 ec a5 f2 51 71 e2 f3 58 2e fc fb 7c 72 |I5....Qq..X...|r|
+| 97 ae 6c d2 2e 73 6d 53 70 4c 5a f4 a4 57 8c 28 |..l..smSpLZ..W.(|
+| 46 f4 44 1e 87 e7 73 05 e9 c3 a1 11 ea 79 15 f7 |F.D...s......y..|
+| af ed 9e ca 01 65 04 90 |.....e.. |
+Client MAC key[20]:
+| e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..|
+| 09 e9 9c bb |.... |
+Server MAC key[20]:
+| 35 34 7d 77 eb 01 da 5d ac 66 fa 8e b0 28 d9 1b |54}w...].f...(..|
+| 2e 55 0a ea |.U.. |
+Client Write key[16]:
+| 28 86 2c 89 f1 f7 56 57 49 35 17 ec a5 f2 51 71 |(.,...VWI5....Qq|
+Server Write key[16]:
+| e2 f3 58 2e fc fb 7c 72 97 ae 6c d2 2e 73 6d 53 |..X...|r..l..smS|
+Client Write IV[16]:
+| 70 4c 5a f4 a4 57 8c 28 46 f4 44 1e 87 e7 73 05 |pLZ..W.(F.D...s.|
+Server Write IV[16]:
+| e9 c3 a1 11 ea 79 15 f7 af ed 9e ca 01 65 04 90 |.....y.......e..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 86 c4 12 44 4e 5f 67 a3 a8 d9 78 e6 98 0b 1e 5c |...DN_g...x....\|
+| 4a 22 d5 34 dd fd 05 04 7b ee e3 6b 27 a9 37 64 |J".4....{..k'.7d|
+| 23 33 26 11 a5 a7 f9 f6 09 eb 75 1b ee d8 0c 7f |#3&.......u.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8e c1 1d 78 27 84 0b f6 5d 80 62 31 d6 62 9a 2a |...x'...].b1.b.*|
+| 6a a9 7f 40 d6 60 0e 0f 2e 83 2e 6f 96 9c a3 b4 |j..@.`.....o....|
+| ec 25 d2 8f ad cd 22 b8 bd 8f c1 68 79 6c 94 21 |.%...."....hyl.!|
+| 1b 38 8c 15 13 9d 53 3c 26 67 6c 5a df 1a b3 a4 |.8....S<&glZ....|
+Plaintext[64]:
+| e2 e2 96 8f 86 7f 78 38 02 f5 7e 71 6c 3b 29 1a |......x8..~ql;).|
+| 14 00 00 0c 49 9a ba 47 9e 4d 41 73 df a7 63 b5 |....I..G.MAs..c.|
+| 4a 04 df 73 37 b8 57 8d 4a dc d4 90 9d 55 58 65 |J..s7.W.J....UXe|
+| 3b 94 d8 43 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |;..C............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4a 04 df 73 37 b8 57 8d 4a dc d4 90 9d 55 58 65 |J..s7.W.J....UXe|
+| 3b 94 d8 43 |;..C |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #384 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b7 bb 14 07 86 e1 cf 41 38 77 8c 9d 15 87 35 63 |.......A8w....5c|
+| be ca 8b e4 1a 77 82 8b b6 d3 1a ac 44 6e 1c 35 |.....w......Dn.5|
+| 04 78 7c be ff 17 09 06 4d d1 5e db cd 06 11 d7 |.x|.....M.^.....|
+| f5 ac d2 99 33 8e d1 3e da e6 fe ec d1 7e 01 32 |....3..>.....~.2|
+Plaintext[64]:
+| 33 11 31 38 99 ba dc 0f 20 20 03 ef 8e e8 50 1f |3.18.... ....P.|
+| 14 00 00 0c 02 ea ce 9b 82 32 06 0e 2d fa 0f d3 |.........2..-...|
+| c4 d5 3f bc f2 82 fd 92 2b 9d df ad c4 bc c0 e7 |..?.....+.......|
+| e5 10 96 e7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c4 d5 3f bc f2 82 fd 92 2b 9d df ad c4 bc c0 e7 |..?.....+.......|
+| e5 10 96 e7 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #385 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 49 84 2c e5 0b 47 70 0e 79 4e 52 4d 15 cb 7f 1c |I.,..Gp.yNRM....|
+| cc ee bc 16 58 a3 13 d7 5e f1 3d 80 2f 68 7c 7c |....X...^.=./h|||
+| 7b 03 28 cf a3 d4 a4 29 6c f4 a0 5a e0 34 db 49 |{.(....)l..Z.4.I|
+| 74 90 c8 26 b4 10 6f f1 76 b6 ae fc 85 49 c8 e4 |t..&..o.v....I..|
+| c5 c8 d2 83 bf b6 30 35 16 4e e5 bf c8 dd c2 06 |......05.N......|
+| d5 05 e4 66 84 74 1b 4e 59 9c a3 23 9e e2 91 48 |...f.t.NY..#...H|
+| 92 69 ec 53 82 c9 e2 0e 97 e5 85 0f 95 33 8d 43 |.i.S.........3.C|
+Plaintext[112]:
+| c5 b3 8a f2 9c 25 1e 08 bc 0b 4b 39 16 58 d4 22 |.....%....K9.X."|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 31 0d 0a 0d 0a 4c 7f b6 69 61 |nl:4481....L..ia|
+| 85 94 bf 79 92 3b 16 49 56 52 c3 1b 62 1c 17 00 |...y.;.IVR..b...|
+ssl_decrypt_record found padding 0 final len 111
+checking mac (len 75, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8e 12 da 40 70 a1 ed a3 d9 04 28 4e bf 75 aa 03 |...@p.....(N.u..|
+| d2 46 73 18 |.Fs. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35376 found (nil)
+association_find: TCP port 4481 found 0x3738060
+
+dissect_ssl enter frame #386 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 32 38 64 3e 3f ae cb 08 79 f3 5a cf e7 2f 24 aa |28d>?...y.Z../$.|
+| 75 bf 8d 9b 5d db bc 95 6f a3 dd d6 66 e8 f0 f5 |u...]...o...f...|
+| 04 19 bf 0f 15 b5 e3 a7 99 d4 68 84 c1 53 9b 1f |..........h..S..|
+| 8e b6 92 8f da 62 e1 e3 9f b5 0c e9 40 04 43 b6 |.....b......@.C.|
+| ec 87 ae 61 d9 71 f7 63 1d 30 f3 9d 37 3d 0d 2c |...a.q.c.0..7=.,|
+| b9 13 de 02 50 d3 23 8d ca 83 ad 12 a9 d9 fb a9 |....P.#.........|
+| 3b c4 9d 6e 15 fe b2 fd da 7c b4 dd be 45 e2 a5 |;..n.....|...E..|
+| 05 05 19 f6 04 25 39 db 0b f1 ff 06 e3 a3 75 69 |.....%9.......ui|
+| 67 f1 a5 1b 7a 2a 26 43 f5 0d d5 ec 09 cf 24 a7 |g...z*&C......$.|
+| 93 d4 42 b7 bd 31 f5 38 77 bb 61 7f 7a 25 79 0b |..B..1.8w.a.z%y.|
+| e3 ca 78 4f 02 d2 61 39 5d e7 70 89 f3 76 42 d2 |..xO..a9].p..vB.|
+| cf 48 60 a4 0b d0 6a 9e 5a a5 38 11 2a 59 07 bb |.H`...j.Z.8.*Y..|
+| ca 85 e7 f7 73 9c dd 43 24 03 a2 a4 7a 71 08 c9 |....s..C$...zq..|
+| 14 55 34 f7 33 92 56 93 ed 55 5e b8 42 d9 7f 31 |.U4.3.V..U^.B..1|
+| dd c4 b0 c7 ae b2 6b 62 74 07 4e 3b 9f 3a d7 29 |......kbt.N;.:.)|
+| 33 77 71 2a bd 66 83 45 34 6f 87 a7 25 59 72 8b |3wq*.f.E4o..%Yr.|
+| c0 c2 a3 c4 5f 2e ae 9a 7b f3 13 7b 14 1b dd 14 |...._...{..{....|
+| 2f 51 1a d9 4b e9 0a f4 c5 fe 2d 85 a6 0d d6 7a |/Q..K.....-....z|
+| a7 08 40 3f 22 25 3c 67 b0 69 ed ac 35 e9 59 e1 |..@?"%<g.i..5.Y.|
+| 14 39 ee e2 af 7a f9 4a 44 12 18 7f 56 ce 21 ab |.9...z.JD...V.!.|
+| 1e e2 b6 60 fc 9b fc 2f 0d 23 4f e5 3f ec 6e 13 |...`.../.#O.?.n.|
+| b5 93 71 d5 ed c2 5a d5 7a de bf 05 13 7c f8 87 |..q...Z.z....|..|
+| 74 f8 62 78 e4 c7 4a df 07 31 7b 01 14 f6 6c 20 |t.bx..J..1{...l |
+| f8 76 0e b8 8c 09 2b 4e 51 03 65 b6 7f f0 5f 66 |.v....+NQ.e..._f|
+| c8 12 ee 1b 0d dc f0 51 c1 b2 fa ee 12 b7 69 c3 |.......Q......i.|
+Plaintext[400]:
+| d0 8e b8 33 02 d6 db 52 db d6 9c 2e c1 f6 2b 77 |...3...R......+w|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:31 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 5f 4c |n.nl'</script>_L|
+| 2c 20 4d 6f 6e a5 41 15 d8 99 26 2f 0e a7 b6 b4 |, Mon.A...&/....|
+| 46 cc 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |F...............|
+ssl_decrypt_record found padding 13 final len 386
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c1 a4 d6 5a 22 35 98 c2 c2 92 e7 15 56 51 50 30 |...Z"5......VQP0|
+| bc ef d0 01 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4481 found 0x3738060
+
+dissect_ssl enter frame #387 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| a2 24 0e 4b e4 fb e3 91 66 67 8c ba 9a fc 55 e8 |.$.K....fg....U.|
+| 58 9c 5a 35 5c dc 59 47 46 36 bf 77 62 6a bc b7 |X.Z5\.YGF6.wbj..|
+| 4a 72 f4 e8 b3 30 61 83 a1 f0 2a b9 2e 19 53 32 |Jr...0a...*...S2|
+Plaintext[48]:
+| 50 f2 d8 3f e8 11 ac cf 61 d0 98 1b 17 cd 66 3f |P..?....a.....f?|
+| 01 00 3f 75 d5 15 f1 b4 79 eb d4 1a de 21 f6 ff |..?u....y....!..|
+| d3 02 5f 2d 42 0c 09 09 09 09 09 09 09 09 09 09 |.._-B...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3f 75 d5 15 f1 b4 79 eb d4 1a de 21 f6 ff d3 02 |?u....y....!....|
+| 5f 2d 42 0c |_-B. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #389 (first time)
+ conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b8 8e c2 4f d4 7e 3a 16 94 9b 45 89 c1 69 e3 2c |...O.~:...E..i.,|
+| 59 8d ac 11 16 c9 6b d8 b1 9c 21 88 8f ff ad 33 |Y.....k...!....3|
+| 03 e5 0a df 48 77 e1 b4 d3 2e b4 c8 1d bd 66 d4 |....Hw........f.|
+Plaintext[48]:
+| 4c d5 85 20 1c f9 39 03 1d 2e b0 32 7e 3f a0 3f |L.. ..9....2~?.?|
+| 01 00 d4 64 1d 91 b0 ac b7 fb a4 18 b8 4e ce ae |...d.........N..|
+| 06 5b 60 4a 16 50 09 09 09 09 09 09 09 09 09 09 |.[`J.P..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d4 64 1d 91 b0 ac b7 fb a4 18 b8 4e ce ae 06 5b |.d.........N...[|
+| 60 4a 16 50 |`J.P |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #394 (first time)
+ssl_session_init: initializing ptr 0x7fca45c03320 size 688
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60960 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4482
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #396 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 86 c4 12 44 4e 5f 67 a3 a8 d9 78 e6 98 0b 1e 5c |...DN_g...x....\|
+| 4a 22 d5 34 dd fd 05 04 7b ee e3 6b 27 a9 37 64 |J".4....{..k'.7d|
+| 23 33 26 11 a5 a7 f9 f6 09 eb 75 1b ee d8 0c 7f |#3&.......u.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 ea 5c eb 07 10 77 49 af 52 62 4d 67 4e 47 e9 |..\...wI.RbMgNG.|
+| 64 ae 7e 84 ab b1 40 90 90 0d 9a 93 40 52 34 c2 |d.~...@.....@R4.|
+| f3 53 f5 a9 55 b8 e7 e9 6e 59 30 58 aa 1b 26 90 |.S..U...nY0X..&.|
+| 5a 5c e8 ff 6c 36 77 0e b2 18 88 35 39 |Z\..l6w....59 |
+hash out[136]:
+| e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...|
+| 26 41 de 71 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 |&A.q...-.h2..N$.|
+| 36 7b 3f e9 0e a9 ac c2 a3 82 08 b2 c4 e9 67 73 |6{?...........gs|
+| 6b 25 cd ba 56 06 13 62 a3 85 2d a4 f7 f1 09 ff |k%..V..b..-.....|
+| 02 53 2b a7 ea 9b 49 ee c8 4e 96 b6 23 63 66 91 |.S+...I..N..#cf.|
+| 58 72 b9 10 43 3c 81 f0 11 93 c0 00 1b 36 29 41 |Xr..C<.......6)A|
+| 25 46 8d 4d a1 96 30 14 ba 5c 0b fb 2d 5d cd 48 |%F.M..0..\..-].H|
+| 3d dc c0 fb 21 ba 79 0d d3 5d ab 20 de 69 4b 60 |=...!.y..]. .iK`|
+| 55 f6 6d f1 66 57 28 8e |U.m.fW(. |
+PRF out[136]:
+| e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...|
+| 26 41 de 71 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 |&A.q...-.h2..N$.|
+| 36 7b 3f e9 0e a9 ac c2 a3 82 08 b2 c4 e9 67 73 |6{?...........gs|
+| 6b 25 cd ba 56 06 13 62 a3 85 2d a4 f7 f1 09 ff |k%..V..b..-.....|
+| 02 53 2b a7 ea 9b 49 ee c8 4e 96 b6 23 63 66 91 |.S+...I..N..#cf.|
+| 58 72 b9 10 43 3c 81 f0 11 93 c0 00 1b 36 29 41 |Xr..C<.......6)A|
+| 25 46 8d 4d a1 96 30 14 ba 5c 0b fb 2d 5d cd 48 |%F.M..0..\..-].H|
+| 3d dc c0 fb 21 ba 79 0d d3 5d ab 20 de 69 4b 60 |=...!.y..]. .iK`|
+| 55 f6 6d f1 66 57 28 8e |U.m.fW(. |
+key expansion[136]:
+| e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...|
+| 26 41 de 71 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 |&A.q...-.h2..N$.|
+| 36 7b 3f e9 0e a9 ac c2 a3 82 08 b2 c4 e9 67 73 |6{?...........gs|
+| 6b 25 cd ba 56 06 13 62 a3 85 2d a4 f7 f1 09 ff |k%..V..b..-.....|
+| 02 53 2b a7 ea 9b 49 ee c8 4e 96 b6 23 63 66 91 |.S+...I..N..#cf.|
+| 58 72 b9 10 43 3c 81 f0 11 93 c0 00 1b 36 29 41 |Xr..C<.......6)A|
+| 25 46 8d 4d a1 96 30 14 ba 5c 0b fb 2d 5d cd 48 |%F.M..0..\..-].H|
+| 3d dc c0 fb 21 ba 79 0d d3 5d ab 20 de 69 4b 60 |=...!.y..]. .iK`|
+| 55 f6 6d f1 66 57 28 8e |U.m.fW(. |
+Client MAC key[20]:
+| e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...|
+| 26 41 de 71 |&A.q |
+Server MAC key[20]:
+| 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 36 7b 3f e9 |...-.h2..N$.6{?.|
+| 0e a9 ac c2 |.... |
+Client Write key[32]:
+| a3 82 08 b2 c4 e9 67 73 6b 25 cd ba 56 06 13 62 |......gsk%..V..b|
+| a3 85 2d a4 f7 f1 09 ff 02 53 2b a7 ea 9b 49 ee |..-......S+...I.|
+Server Write key[32]:
+| c8 4e 96 b6 23 63 66 91 58 72 b9 10 43 3c 81 f0 |.N..#cf.Xr..C<..|
+| 11 93 c0 00 1b 36 29 41 25 46 8d 4d a1 96 30 14 |.....6)A%F.M..0.|
+Client Write IV[16]:
+| ba 5c 0b fb 2d 5d cd 48 3d dc c0 fb 21 ba 79 0d |.\..-].H=...!.y.|
+Server Write IV[16]:
+| d3 5d ab 20 de 69 4b 60 55 f6 6d f1 66 57 28 8e |.]. .iK`U.m.fW(.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #398 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c...
+looking for RSA pre-master6104567b4cafa042e28b0ffd04e4d44a7e1fb88466c1b61b...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 49 e1 03 27 ad 96 80 8a 76 fc 33 9c ff 68 6d b7 |I..'....v.3..hm.|
+| c5 1d e8 5d d3 cc 81 e6 d9 57 1f a3 94 91 62 ca |...].....W....b.|
+| df f2 fd 42 86 47 3d 0b b3 a4 ca 0e 3a 1b db cc |...B.G=.....:...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 ea 5c eb 07 10 77 49 af 52 62 4d 67 4e 47 e9 |..\...wI.RbMgNG.|
+| 64 ae 7e 84 ab b1 40 90 90 0d 9a 93 40 52 34 c2 |d.~...@.....@R4.|
+| f3 53 f5 a9 55 b8 e7 e9 6e 59 30 58 aa 1b 26 90 |.S..U...nY0X..&.|
+| 5a 5c e8 ff 6c 36 77 0e b2 18 88 35 39 |Z\..l6w....59 |
+hash out[136]:
+| 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).|
+| 27 c4 ea 34 d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d |'..4.x.?f...W.(]|
+| dc c5 68 9a ea 0f 4e 6e 4a 0e cc 9b 33 e9 3a 8d |..h...NnJ...3.:.|
+| e3 ed f6 03 f8 1c 87 a9 c0 16 72 ff e8 9f fb d7 |..........r.....|
+| b8 fc 1c 21 89 b3 84 83 55 80 a8 51 51 25 c4 9a |...!....U..QQ%..|
+| ca 94 08 e1 a3 e7 56 5e c8 d2 0f 60 a1 63 7c 18 |......V^...`.c|.|
+| 83 72 52 c9 70 80 93 13 6a 15 e1 f3 5d 0e e8 26 |.rR.p...j...]..&|
+| 48 5a 14 c5 31 15 05 9a 05 06 5f 95 44 3f 7b 0a |HZ..1....._.D?{.|
+| e5 ec df fa f0 98 95 5b |.......[ |
+PRF out[136]:
+| 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).|
+| 27 c4 ea 34 d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d |'..4.x.?f...W.(]|
+| dc c5 68 9a ea 0f 4e 6e 4a 0e cc 9b 33 e9 3a 8d |..h...NnJ...3.:.|
+| e3 ed f6 03 f8 1c 87 a9 c0 16 72 ff e8 9f fb d7 |..........r.....|
+| b8 fc 1c 21 89 b3 84 83 55 80 a8 51 51 25 c4 9a |...!....U..QQ%..|
+| ca 94 08 e1 a3 e7 56 5e c8 d2 0f 60 a1 63 7c 18 |......V^...`.c|.|
+| 83 72 52 c9 70 80 93 13 6a 15 e1 f3 5d 0e e8 26 |.rR.p...j...]..&|
+| 48 5a 14 c5 31 15 05 9a 05 06 5f 95 44 3f 7b 0a |HZ..1....._.D?{.|
+| e5 ec df fa f0 98 95 5b |.......[ |
+key expansion[136]:
+| 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).|
+| 27 c4 ea 34 d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d |'..4.x.?f...W.(]|
+| dc c5 68 9a ea 0f 4e 6e 4a 0e cc 9b 33 e9 3a 8d |..h...NnJ...3.:.|
+| e3 ed f6 03 f8 1c 87 a9 c0 16 72 ff e8 9f fb d7 |..........r.....|
+| b8 fc 1c 21 89 b3 84 83 55 80 a8 51 51 25 c4 9a |...!....U..QQ%..|
+| ca 94 08 e1 a3 e7 56 5e c8 d2 0f 60 a1 63 7c 18 |......V^...`.c|.|
+| 83 72 52 c9 70 80 93 13 6a 15 e1 f3 5d 0e e8 26 |.rR.p...j...]..&|
+| 48 5a 14 c5 31 15 05 9a 05 06 5f 95 44 3f 7b 0a |HZ..1....._.D?{.|
+| e5 ec df fa f0 98 95 5b |.......[ |
+Client MAC key[20]:
+| 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).|
+| 27 c4 ea 34 |'..4 |
+Server MAC key[20]:
+| d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d dc c5 68 9a |.x.?f...W.(]..h.|
+| ea 0f 4e 6e |..Nn |
+Client Write key[32]:
+| 4a 0e cc 9b 33 e9 3a 8d e3 ed f6 03 f8 1c 87 a9 |J...3.:.........|
+| c0 16 72 ff e8 9f fb d7 b8 fc 1c 21 89 b3 84 83 |..r........!....|
+Server Write key[32]:
+| 55 80 a8 51 51 25 c4 9a ca 94 08 e1 a3 e7 56 5e |U..QQ%........V^|
+| c8 d2 0f 60 a1 63 7c 18 83 72 52 c9 70 80 93 13 |...`.c|..rR.p...|
+Client Write IV[16]:
+| 6a 15 e1 f3 5d 0e e8 26 48 5a 14 c5 31 15 05 9a |j...]..&HZ..1...|
+Server Write IV[16]:
+| 05 06 5f 95 44 3f 7b 0a e5 ec df fa f0 98 95 5b |.._.D?{........[|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 49 e1 03 27 ad 96 80 8a 76 fc 33 9c ff 68 6d b7 |I..'....v.3..hm.|
+| c5 1d e8 5d d3 cc 81 e6 d9 57 1f a3 94 91 62 ca |...].....W....b.|
+| df f2 fd 42 86 47 3d 0b b3 a4 ca 0e 3a 1b db cc |...B.G=.....:...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| bb 79 6b a1 ec a1 98 ed ef 7d 5d b0 6e a5 a3 82 |.yk......}].n...|
+| db 76 70 9f 0a 50 9e 7e 72 de b1 a9 f3 b3 31 c2 |.vp..P.~r.....1.|
+| fe 5e 32 57 ac 45 c9 49 69 52 1d fd fd 50 77 e4 |.^2W.E.IiR...Pw.|
+| 53 28 40 7f c9 2a fa 46 02 a1 6b b1 20 2c 94 f3 |S(@..*.F..k. ,..|
+Plaintext[64]:
+| 78 12 f6 0f a3 20 48 8a 0b a7 10 4b ef 71 e5 2c |x.... H....K.q.,|
+| 14 00 00 0c 0e 27 c5 25 9e 5e 51 e8 55 75 53 92 |.....'.%.^Q.UuS.|
+| 8f 02 a0 b4 00 ce ac eb 80 2e b0 e7 69 1f 6a 8f |............i.j.|
+| ac c0 33 21 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..3!............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8f 02 a0 b4 00 ce ac eb 80 2e b0 e7 69 1f 6a 8f |............i.j.|
+| ac c0 33 21 |..3! |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #399 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 98 77 5d d3 c7 44 00 e3 53 5d 61 fd 2c 03 89 19 |.w]..D..S]a.,...|
+| 14 8a 10 14 4d 44 62 26 2a a0 1b 31 fe 23 33 0e |....MDb&*..1.#3.|
+| ab 6b 6b 73 d9 fb 1c 05 45 32 85 17 b2 d4 cb 73 |.kks....E2.....s|
+| 55 16 7e 6a fc 67 1f 40 bb 71 12 ce 2f 78 f8 e6 |U.~j.g.@.q../x..|
+Plaintext[64]:
+| dc 7c dd ee 49 3e f9 07 d3 08 c3 62 28 46 34 c1 |.|..I>.....b(F4.|
+| 14 00 00 0c bb 5e a4 b5 4f 62 bd 7c e1 3d 41 9b |.....^..Ob.|.=A.|
+| 30 d6 85 81 1c d8 23 cf d4 78 69 9d 7d 4c d7 51 |0.....#..xi.}L.Q|
+| 0f 69 03 12 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.i..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 30 d6 85 81 1c d8 23 cf d4 78 69 9d 7d 4c d7 51 |0.....#..xi.}L.Q|
+| 0f 69 03 12 |.i.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #400 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 4b 8e 42 fa 9e e7 6d 30 f8 a4 d5 4c 07 7f 91 c6 |K.B...m0...L....|
+| d7 e0 fc 0d 56 c4 bb 3c 9c c2 b7 23 7f 02 7a d7 |....V..<...#..z.|
+| 49 2a 76 d3 17 c9 4a 45 74 1d 9c f3 0e f0 cb 5b |I*v...JEt......[|
+| 6a ad 6f b4 ea 0d d7 f3 e2 1c 25 d2 b7 e3 1b dc |j.o.......%.....|
+| 9c 90 be 15 82 ac a9 7b 6e 38 30 d8 50 89 66 d6 |.......{n80.P.f.|
+| 62 6c cf ba f9 0d a4 82 26 55 22 90 d3 f8 02 72 |bl......&U"....r|
+| 50 fd ad 79 85 0a 70 04 ce 21 83 16 6f 40 fe 99 |P..y..p..!..o@..|
+Plaintext[112]:
+| 87 7c ff 3a 1d a1 b0 a2 79 85 27 4d d6 df 14 65 |.|.:....y.'M...e|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 32 0d 0a 0d 0a ce e2 4b 0d f0 |nl:4482......K..|
+| 9a 7a aa de a7 f3 f5 8f d6 a3 9b 0a f1 38 cb 00 |.z...........8..|
+ssl_decrypt_record found padding 0 final len 111
+checking mac (len 75, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 04 bd 33 a9 f1 b9 57 2c d0 d7 76 86 8f 86 f6 2a |..3...W,..v....*|
+| ee bf 95 2a |...* |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60960 found (nil)
+association_find: TCP port 4482 found 0x37380f0
+
+dissect_ssl enter frame #401 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fa bf dd 7f 6c c3 1d d9 e9 b4 43 ba 7c 13 94 80 |....l.....C.|...|
+| b1 51 a5 08 14 40 af 5b 18 b6 4e 0c 49 bb f1 4d |.Q...@.[..N.I..M|
+| 38 6e 13 9d 86 7e 6f f8 9f 8e 07 e8 f6 bb b1 d0 |8n...~o.........|
+| f5 0f 10 73 1b 2c 9c f5 8c 38 00 a0 2b 7a 83 58 |...s.,...8..+z.X|
+| ee a5 c4 3f 4a a0 43 e6 f5 1e b4 f5 d8 f7 14 03 |...?J.C.........|
+| bb d2 68 fe 69 7c d6 70 b5 b7 3e 07 08 b7 26 05 |..h.i|.p..>...&.|
+| e9 e2 f7 58 ff a0 38 ad cd d3 d3 a4 0b e9 b7 dc |...X..8.........|
+| c8 90 c4 f6 36 db 7d 15 24 4d 6f 75 0b 1f 36 c2 |....6.}.$Mou..6.|
+| 63 4d ee d1 88 c1 be 12 cd e7 e5 99 f8 b4 1d 58 |cM.............X|
+| 26 10 ed ab c4 da 08 e2 f8 7d 8c a6 df 44 92 91 |&........}...D..|
+| 68 e1 fd 1d 15 7a d5 50 98 ff 2e f2 9b c3 2a fb |h....z.P......*.|
+| 49 c9 52 a9 4a 23 5c 98 eb 0b f5 fe 2c c5 48 4e |I.R.J#\.....,.HN|
+| 4c f8 ec c1 22 41 05 36 5a 4c e0 40 50 fc 43 8a |L..."A.6ZL.@P.C.|
+| 75 e3 62 58 46 58 6c ff 4a 9d 3b 32 75 a9 d4 a0 |u.bXFXl.J.;2u...|
+| 13 5d 6e 6b 04 11 f2 ea 05 2b 81 3a 2e 3d 71 7c |.]nk.....+.:.=q||
+| 4f 6f 24 52 29 c4 02 3f 01 f3 4d e1 ba 50 83 b9 |Oo$R)..?..M..P..|
+| 37 1d 61 b6 93 29 75 d1 64 37 17 ba a9 a3 06 d3 |7.a..)u.d7......|
+| ca ea 87 c3 b6 20 bd b6 26 30 71 39 ff 46 41 83 |..... ..&0q9.FA.|
+| 1a ae 60 57 94 9f 2a 0f 05 86 34 67 52 0d 9b 2c |..`W..*...4gR..,|
+| 12 d9 ae 05 63 80 d9 ac 65 e0 cf 63 65 b3 69 f4 |....c...e..ce.i.|
+| 38 c5 dc 28 fa 54 91 5e 73 14 13 3f eb 51 3f 88 |8..(.T.^s..?.Q?.|
+| 3c aa af c1 7f 18 34 0f c3 22 29 cb a2 b3 cd d6 |<.....4..").....|
+| 1f ae a0 77 09 14 91 3e 4f 40 1d ab b8 c6 bc ce |...w...>O@......|
+| b3 55 21 ac 65 5a 8c 9f 0d 56 45 36 90 23 40 58 |.U!.eZ...VE6.#@X|
+| 29 75 e8 ce 86 0f 1d 83 f1 4b 8f 32 91 c5 41 2c |)u.......K.2..A,|
+Plaintext[400]:
+| 77 27 ad e0 ab 36 11 b5 c5 a4 82 19 f8 cc 9d d3 |w'...6..........|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:31 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 76 a6 |n.nl'</script>v.|
+| 98 67 5f 6b 1f 37 17 c3 a4 b2 e9 f4 cf 2f 9b 5b |.g_k.7......./.[|
+| 07 fd 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |................|
+ssl_decrypt_record found padding 13 final len 386
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ac 7a 1e 70 39 6f 28 c5 58 c6 8c 4c 8c 68 2e 87 |.z.p9o(.X..L.h..|
+| b0 b0 55 42 |..UB |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4482 found 0x37380f0
+
+dissect_ssl enter frame #402 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 43 9d 1d ec 16 db 4b 21 92 33 44 21 bf 64 ea 0e |C.....K!.3D!.d..|
+| a3 ff d7 79 58 85 12 28 88 28 d8 c4 de 0d b4 66 |...yX..(.(.....f|
+| 44 9e 72 63 da 8c 54 30 54 96 23 ab 38 c2 65 38 |D.rc..T0T.#.8.e8|
+Plaintext[48]:
+| 5b 00 32 f8 16 cb 6c 49 0a c3 83 80 0d fd 66 24 |[.2...lI......f$|
+| 01 00 b7 90 df c8 cb 98 41 b4 d7 cd b6 6f 82 53 |........A....o.S|
+| 55 00 b1 40 53 25 09 09 09 09 09 09 09 09 09 09 |U..@S%..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b7 90 df c8 cb 98 41 b4 d7 cd b6 6f 82 53 55 00 |......A....o.SU.|
+| b1 40 53 25 |.@S% |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #404 (first time)
+ conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| bd 28 67 88 30 d4 72 a1 4c 34 7a 6a 5d 13 0a 2b |.(g.0.r.L4zj]..+|
+| fb 2f 4e 82 5c 7c 0f b1 08 07 6e 1f e3 81 a9 a7 |./N.\|....n.....|
+| d4 be bb e3 b7 9d 27 aa 01 b0 20 a5 59 09 3d a5 |......'... .Y.=.|
+Plaintext[48]:
+| 2f ed 46 41 3a 22 a4 bf 7f 2e a1 40 99 14 a4 7d |/.FA:".....@...}|
+| 01 00 64 1e 8e 0d 0d 98 0b d2 f3 dd e2 b4 ba 87 |..d.............|
+| ed d8 ae 37 8b e0 09 09 09 09 09 09 09 09 09 09 |...7............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 64 1e 8e 0d 0d 98 0b d2 f3 dd e2 b4 ba 87 ed d8 |d...............|
+| ae 37 8b e0 |.7.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #409 (first time)
+ssl_session_init: initializing ptr 0x7fca45c05800 size 688
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 36616 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4484
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #411 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 750
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 49 e1 03 27 ad 96 80 8a 76 fc 33 9c ff 68 6d b7 |I..'....v.3..hm.|
+| c5 1d e8 5d d3 cc 81 e6 d9 57 1f a3 94 91 62 ca |...].....W....b.|
+| df f2 fd 42 86 47 3d 0b b3 a4 ca 0e 3a 1b db cc |...B.G=.....:...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 76 7d 57 c7 3b 3b 64 df 63 69 82 c2 a5 db 19 |.v}W.;;d.ci.....|
+| 7f 7e a7 3c 02 7e b4 4a e4 05 cb 7c 2e 52 34 c2 |.~.<.~.J...|.R4.|
+| f3 3d 02 71 3b e9 4b 00 5a 27 e8 ad 85 4d b7 e2 |.=.q;.K.Z'...M..|
+| 65 e0 4b f4 90 64 b2 d3 3f 46 f7 03 d2 |e.K..d..?F... |
+hash out[104]:
+| 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...|
+| df ea 29 93 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 |..).c......|...x|
+| d8 c7 39 77 da 1d ab fa fc 07 24 5e cb c9 d2 e3 |..9w......$^....|
+| 0d bf 8d c2 83 6e 91 50 a4 6a 34 da 04 3b 66 d7 |.....n.P.j4..;f.|
+| b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.|
+| d0 50 32 47 49 66 0e 88 39 56 83 17 9f c3 53 c4 |.P2GIf..9V....S.|
+| 0e 32 ec 22 0d 4b 17 da |.2.".K.. |
+PRF out[104]:
+| 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...|
+| df ea 29 93 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 |..).c......|...x|
+| d8 c7 39 77 da 1d ab fa fc 07 24 5e cb c9 d2 e3 |..9w......$^....|
+| 0d bf 8d c2 83 6e 91 50 a4 6a 34 da 04 3b 66 d7 |.....n.P.j4..;f.|
+| b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.|
+| d0 50 32 47 49 66 0e 88 39 56 83 17 9f c3 53 c4 |.P2GIf..9V....S.|
+| 0e 32 ec 22 0d 4b 17 da |.2.".K.. |
+key expansion[104]:
+| 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...|
+| df ea 29 93 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 |..).c......|...x|
+| d8 c7 39 77 da 1d ab fa fc 07 24 5e cb c9 d2 e3 |..9w......$^....|
+| 0d bf 8d c2 83 6e 91 50 a4 6a 34 da 04 3b 66 d7 |.....n.P.j4..;f.|
+| b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.|
+| d0 50 32 47 49 66 0e 88 39 56 83 17 9f c3 53 c4 |.P2GIf..9V....S.|
+| 0e 32 ec 22 0d 4b 17 da |.2.".K.. |
+Client MAC key[20]:
+| 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...|
+| df ea 29 93 |..). |
+Server MAC key[20]:
+| 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 d8 c7 39 77 |c......|...x..9w|
+| da 1d ab fa |.... |
+Client Write key[24]:
+| fc 07 24 5e cb c9 d2 e3 0d bf 8d c2 83 6e 91 50 |..$^.........n.P|
+| a4 6a 34 da 04 3b 66 d7 |.j4..;f. |
+Server Write key[24]:
+| b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.|
+| d0 50 32 47 49 66 0e 88 |.P2GIf.. |
+Client Write IV[8]:
+| 39 56 83 17 9f c3 53 c4 |9V....S. |
+Server Write IV[8]:
+| 0e 32 ec 22 0d 4b 17 da |.2.".K.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 679
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 194
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 180, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741
+ record: offset = 741, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750
+
+dissect_ssl enter frame #413 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf490...
+looking for RSA pre-master4104458e6a57e4b7b005ce280dd331641c7d463ab55640b6...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 50 78 7b 46 43 0a 89 3b 23 55 d9 2a ef 47 4b 50 |Px{FC..;#U.*.GKP|
+| 06 7d 82 52 ec 54 4e 90 4d cc 03 75 da be 46 ac |.}.R.TN.M..u..F.|
+| 75 97 c4 ec b6 2a 87 7b 39 d5 c0 46 bc cf f5 d7 |u....*.{9..F....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 76 7d 57 c7 3b 3b 64 df 63 69 82 c2 a5 db 19 |.v}W.;;d.ci.....|
+| 7f 7e a7 3c 02 7e b4 4a e4 05 cb 7c 2e 52 34 c2 |.~.<.~.J...|.R4.|
+| f3 3d 02 71 3b e9 4b 00 5a 27 e8 ad 85 4d b7 e2 |.=.q;.K.Z'...M..|
+| 65 e0 4b f4 90 64 b2 d3 3f 46 f7 03 d2 |e.K..d..?F... |
+hash out[104]:
+| 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+|
+| 69 69 6a cf e9 d4 62 d8 8d 32 40 84 99 17 45 1e |iij...b..2@...E.|
+| 9c 7b 37 46 bf cf 32 98 64 2d 40 ce 2b b7 19 26 |.{7F..2.d-@.+..&|
+| 78 1e 19 c4 e3 2c d4 e5 b0 56 69 76 c1 f4 14 ee |x....,...Viv....|
+| a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.||
+| 55 22 2d 90 ea 17 e1 5b d2 cf 6b b7 03 1d 22 35 |U"-....[..k..."5|
+| 0c 9a 04 f6 d8 9a 3d 1b |......=. |
+PRF out[104]:
+| 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+|
+| 69 69 6a cf e9 d4 62 d8 8d 32 40 84 99 17 45 1e |iij...b..2@...E.|
+| 9c 7b 37 46 bf cf 32 98 64 2d 40 ce 2b b7 19 26 |.{7F..2.d-@.+..&|
+| 78 1e 19 c4 e3 2c d4 e5 b0 56 69 76 c1 f4 14 ee |x....,...Viv....|
+| a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.||
+| 55 22 2d 90 ea 17 e1 5b d2 cf 6b b7 03 1d 22 35 |U"-....[..k..."5|
+| 0c 9a 04 f6 d8 9a 3d 1b |......=. |
+key expansion[104]:
+| 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+|
+| 69 69 6a cf e9 d4 62 d8 8d 32 40 84 99 17 45 1e |iij...b..2@...E.|
+| 9c 7b 37 46 bf cf 32 98 64 2d 40 ce 2b b7 19 26 |.{7F..2.d-@.+..&|
+| 78 1e 19 c4 e3 2c d4 e5 b0 56 69 76 c1 f4 14 ee |x....,...Viv....|
+| a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.||
+| 55 22 2d 90 ea 17 e1 5b d2 cf 6b b7 03 1d 22 35 |U"-....[..k..."5|
+| 0c 9a 04 f6 d8 9a 3d 1b |......=. |
+Client MAC key[20]:
+| 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+|
+| 69 69 6a cf |iij. |
+Server MAC key[20]:
+| e9 d4 62 d8 8d 32 40 84 99 17 45 1e 9c 7b 37 46 |..b..2@...E..{7F|
+| bf cf 32 98 |..2. |
+Client Write key[24]:
+| 64 2d 40 ce 2b b7 19 26 78 1e 19 c4 e3 2c d4 e5 |d-@.+..&x....,..|
+| b0 56 69 76 c1 f4 14 ee |.Viv.... |
+Server Write key[24]:
+| a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.||
+| 55 22 2d 90 ea 17 e1 5b |U"-....[ |
+Client Write IV[8]:
+| d2 cf 6b b7 03 1d 22 35 |..k..."5 |
+Server Write IV[8]:
+| 0c 9a 04 f6 d8 9a 3d 1b |......=. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 50 78 7b 46 43 0a 89 3b 23 55 d9 2a ef 47 4b 50 |Px{FC..;#U.*.GKP|
+| 06 7d 82 52 ec 54 4e 90 4d cc 03 75 da be 46 ac |.}.R.TN.M..u..F.|
+| 75 97 c4 ec b6 2a 87 7b 39 d5 c0 46 bc cf f5 d7 |u....*.{9..F....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 73 4b f1 fc 7d 3e 75 4a 16 a7 c6 0a 6d 4d 45 bb |sK..}>uJ....mME.|
+| b8 bd 31 57 36 a4 59 70 d4 fd 6c e3 32 26 ce c7 |..1W6.Yp..l.2&..|
+| 58 1a c0 90 ea bc 3e 3f 9d 7e a4 75 fd 5f a1 8e |X.....>?.~.u._..|
+Plaintext[48]:
+| 36 11 39 5d 12 d1 d5 32 14 00 00 0c ef 69 a0 25 |6.9]...2.....i.%|
+| ac 05 9f 3a 45 c7 cc 59 cd 74 5c 55 c6 38 45 c2 |...:E..Y.t\U.8E.|
+| 6c b6 61 93 2d 93 af 0d 18 2f 08 c9 03 03 03 03 |l.a.-..../......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 74 5c 55 c6 38 45 c2 6c b6 61 93 2d 93 af 0d |.t\U.8E.l.a.-...|
+| 18 2f 08 c9 |./.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #414 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 96 32 03 84 ba 08 ca 89 3d 63 37 f9 75 3a aa 0b |.2......=c7.u:..|
+| 64 6d 4a 6d 58 b8 b1 60 d5 e9 4b 30 a9 40 3d 1a |dmJmX..`..K0.@=.|
+| 0c 63 29 61 e0 d4 97 c0 b4 90 62 3e a4 71 8f 56 |.c)a......b>.q.V|
+Plaintext[48]:
+| 44 cf b6 c5 04 2d b8 7b 14 00 00 0c 7f 48 91 e0 |D....-.{.....H..|
+| 4b 61 ae fd 66 36 d7 0f 89 4d 0d 11 2d 69 ca 78 |Ka..f6...M..-i.x|
+| d3 45 0b 79 3e 9b b0 0a ef 72 03 83 03 03 03 03 |.E.y>....r......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 89 4d 0d 11 2d 69 ca 78 d3 45 0b 79 3e 9b b0 0a |.M..-i.x.E.y>...|
+| ef 72 03 83 |.r.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #415 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 8d 21 cf 4f 44 65 57 8d a6 74 17 51 35 d7 db 31 |.!.ODeW..t.Q5..1|
+| 0a ff 82 c1 fa 8d 92 a7 fc 83 55 b1 46 39 8e ba |..........U.F9..|
+| 00 29 f3 9d 93 af e7 4a f3 0d 94 90 2e bc 8f a2 |.).....J........|
+| 0b 87 58 f3 ab 0a 80 ac 25 18 cc 4e 6a 29 e1 e9 |..X.....%..Nj)..|
+| 22 44 95 16 8f 82 2a 48 9a d0 e9 fa 37 86 cc 07 |"D....*H....7...|
+| 5b 0f dc c9 ff ca e5 1b 2e 97 33 83 0a 9a 08 30 |[.........3....0|
+| 4d 76 19 07 61 13 32 bc 4b 72 53 df e2 d2 93 f8 |Mv..a.2.KrS.....|
+Plaintext[112]:
+| 8c a3 dd 3f 07 3c ea 28 47 45 54 20 2f 20 48 54 |...?.<.(GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 65 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 |dhe-ecdsa-des-cb|
+| 63 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |c3-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 38 34 0d 0a 0d 0a 1b 95 14 86 23 fc f1 7a 07 c7 |84........#..z..|
+| d0 a2 4b bc b2 02 1b e6 60 a2 05 05 05 05 05 05 |..K.....`.......|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 78, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 57 be ff 9d 6a f8 10 5a 9c 88 6f ba 05 b0 28 17 |W...j..Z..o...(.|
+| b5 d5 2f ad |../. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 36616 found (nil)
+association_find: TCP port 4484 found 0x3738210
+
+dissect_ssl enter frame #416 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| a6 27 0c 4d 4b d1 f9 a9 6e 0c 7c 18 98 5e 7e ba |.'.MK...n.|..^~.|
+| 38 95 5d e4 e7 d1 33 e6 0e de e9 c7 53 52 a1 3c |8.]...3.....SR.<|
+| 9d ea 5a 08 29 cc 7f 7e d6 f3 d5 e7 bd 13 26 d6 |..Z.)..~......&.|
+| 8a 8c f4 ad c7 89 5e 5b 63 16 96 dd a5 c4 3d f4 |......^[c.....=.|
+| a4 7c ba 3a 6c f6 48 e8 cd a3 f0 52 db 80 cb c7 |.|.:l.H....R....|
+| b4 3f c7 5c 1a c1 7c e5 c4 2a 5d f4 a6 65 a7 d0 |.?.\..|..*]..e..|
+| 9e e8 82 ee 7f d7 bc 31 39 98 c9 23 b6 2a 92 96 |.......19..#.*..|
+| a7 36 60 97 f8 a5 0b 6a 49 75 b4 b9 8c c8 e0 5f |.6`....jIu....._|
+| 7c 2e 11 9d 2f 4c 68 84 d6 72 0f 6d bd 94 9f 04 ||.../Lh..r.m....|
+| cd 16 2f 17 7e c2 69 e6 c8 95 6a bc 8b 84 c4 b9 |../.~.i...j.....|
+| ff ac 79 62 e6 f0 e1 b1 87 82 ae 36 d7 be a2 34 |..yb.......6...4|
+| 41 5b 28 8c 81 1e 2b f4 82 1a 8d 34 ce 18 ff f9 |A[(...+....4....|
+| 79 48 51 65 f4 7c d7 63 1f 18 e4 0e a4 e8 1a 02 |yHQe.|.c........|
+| c1 b3 e9 09 b6 0c c6 24 65 4e 63 e4 76 0e 68 61 |.......$eNc.v.ha|
+| e7 cb 51 0c d0 2e 83 1f 0e 3b 9a 9d ff c0 b4 8e |..Q......;......|
+| 42 83 cc 93 bb d7 ec b3 f7 e7 f6 2b 0a 4a e5 4f |B..........+.J.O|
+| 88 60 24 2f 42 95 97 a0 2a 8d be d9 6e c0 01 5e |.`$/B...*...n..^|
+| 48 73 3b eb 86 8b 4e 71 e2 b0 e2 78 d8 9a 49 ae |Hs;...Nq...x..I.|
+| 7d 17 69 3d ed e1 ff 1e 37 08 d9 e2 af 14 30 42 |}.i=....7.....0B|
+| 1d 9c af 1e 79 f0 80 be 47 b0 82 9d 20 dc b7 9e |....y...G... ...|
+| 82 f7 35 4d 68 b2 25 3b c7 b3 b2 69 5a 89 87 66 |..5Mh.%;...iZ..f|
+| ba 81 e8 e1 ec 47 df 49 1b 7f df 5d 10 09 d6 51 |.....G.I...]...Q|
+| 5d ca 46 45 20 9b 97 da 37 a7 03 e4 39 1f 6a 87 |].FE ...7...9.j.|
+| 37 ef b3 7a 0b 8e 98 93 41 48 68 b3 69 84 de e3 |7..z....AHh.i...|
+Plaintext[384]:
+| 53 33 d2 1c d0 e6 7d a9 48 54 54 50 2f 31 2e 31 |S3....}.HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 33 31 20 47 4d |2013 20:11:31 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 38 |che....0xC0,0x08|
+| 20 2d 20 45 43 44 48 45 2d 45 43 44 53 41 2d 44 | - ECDHE-ECDSA-D|
+| 45 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 |ES-CBC3-SHA SSLv|
+| 33 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 |3 Kx=ECDH Au|
+| 3d 45 43 44 53 41 20 45 6e 63 3d 33 44 45 53 28 |=ECDSA Enc=3DES(|
+| 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1<sc|
+| 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f |ript>document.do|
+| 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'</s|
+| 63 72 69 70 74 3e fa 4b 0e cd 76 82 4a e9 ad 5a |cript>.K..v.J..Z|
+| e1 86 2a 24 ee 0f 6f 36 be 87 05 05 05 05 05 05 |..*$..o6........|
+ssl_decrypt_record found padding 5 final len 378
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 38 2d 7f 46 7e 2a 25 9c ab 68 5f 5f e8 1c a1 d2 |8-.F~*%..h__....|
+| d7 11 ad dd |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4484 found 0x3738210
+
+dissect_ssl enter frame #417 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 33 e8 6d 3d 0d 2d c8 07 76 fa bb 56 76 17 d8 d0 |3.m=.-..v..Vv...|
+| 39 52 be 92 1f e7 a1 fa 4d 5d 89 ac c6 ea c7 a6 |9R......M]......|
+Plaintext[32]:
+| 6c c1 03 87 c6 89 2e 47 01 00 66 e8 82 84 37 1f |l......G..f...7.|
+| 12 bb ee 1f 57 0b 37 c3 05 13 80 6c 1c 75 01 01 |....W.7....l.u..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 66 e8 82 84 37 1f 12 bb ee 1f 57 0b 37 c3 05 13 |f...7.....W.7...|
+| 80 6c 1c 75 |.l.u |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #419 (first time)
+ conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 8f 0f 00 82 03 2f 39 46 a1 bd 7c f6 59 ed 74 05 |...../9F..|.Y.t.|
+| 74 45 86 c4 80 5b 79 7c 35 90 3a 9e 0d c2 d2 a5 |tE...[y|5.:.....|
+Plaintext[32]:
+| 6c 9c 35 14 01 43 7a e8 01 00 12 c0 f8 f7 00 97 |l.5..Cz.........|
+| 56 1f 8f 1b 29 62 af eb b9 95 0a 85 aa c8 01 01 |V...)b..........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 c0 f8 f7 00 97 56 1f 8f 1b 29 62 af eb b9 95 |......V...)b....|
+| 0a 85 aa c8 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #424 (first time)
+ssl_session_init: initializing ptr 0x7fca45c07d00 size 688
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 39714 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4485
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #426 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 751
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 50 78 7b 46 43 0a 89 3b 23 55 d9 2a ef 47 4b 50 |Px{FC..;#U.*.GKP|
+| 06 7d 82 52 ec 54 4e 90 4d cc 03 75 da be 46 ac |.}.R.TN.M..u..F.|
+| 75 97 c4 ec b6 2a 87 7b 39 d5 c0 46 bc cf f5 d7 |u....*.{9..F....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 f8 5e 50 3f 39 bb b6 0e 91 46 5b 12 62 2d 25 |..^P?9....F[.b-%|
+| ae 6d 94 a0 09 83 23 9d 3f 3d 13 34 e5 52 34 c2 |.m....#.?=.4.R4.|
+| f3 5b c3 b6 25 01 5f 9e 96 5f 41 c8 85 c3 eb b8 |.[..%._.._A.....|
+| fb 55 9d f8 e2 43 bc 09 6a de 43 7e eb |.U...C..j.C~. |
+hash out[104]:
+| 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4|
+| 18 cc c3 5b fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 |...[..>.[...k...|
+| e8 77 fb 21 72 cf 29 f9 02 f5 84 7f ac ac e4 6d |.w.!r.)........m|
+| e2 46 8c 2a f8 f0 be da 97 7f f7 90 55 ee 44 34 |.F.*........U.D4|
+| ba 01 e3 c5 73 33 4d b8 b6 37 b5 a7 f3 3e ad 69 |....s3M..7...>.i|
+| e9 9f 5d 32 d9 d7 02 2b 29 26 46 6f 70 87 c3 d2 |..]2...+)&Fop...|
+| d3 96 09 aa 04 c6 12 3a |.......: |
+PRF out[104]:
+| 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4|
+| 18 cc c3 5b fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 |...[..>.[...k...|
+| e8 77 fb 21 72 cf 29 f9 02 f5 84 7f ac ac e4 6d |.w.!r.)........m|
+| e2 46 8c 2a f8 f0 be da 97 7f f7 90 55 ee 44 34 |.F.*........U.D4|
+| ba 01 e3 c5 73 33 4d b8 b6 37 b5 a7 f3 3e ad 69 |....s3M..7...>.i|
+| e9 9f 5d 32 d9 d7 02 2b 29 26 46 6f 70 87 c3 d2 |..]2...+)&Fop...|
+| d3 96 09 aa 04 c6 12 3a |.......: |
+key expansion[104]:
+| 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4|
+| 18 cc c3 5b fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 |...[..>.[...k...|
+| e8 77 fb 21 72 cf 29 f9 02 f5 84 7f ac ac e4 6d |.w.!r.)........m|
+| e2 46 8c 2a f8 f0 be da 97 7f f7 90 55 ee 44 34 |.F.*........U.D4|
+| ba 01 e3 c5 73 33 4d b8 b6 37 b5 a7 f3 3e ad 69 |....s3M..7...>.i|
+| e9 9f 5d 32 d9 d7 02 2b 29 26 46 6f 70 87 c3 d2 |..]2...+)&Fop...|
+| d3 96 09 aa 04 c6 12 3a |.......: |
+Client MAC key[20]:
+| 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4|
+| 18 cc c3 5b |...[ |
+Server MAC key[20]:
+| fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 e8 77 fb 21 |..>.[...k....w.!|
+| 72 cf 29 f9 |r.). |
+Client Write key[16]:
+| 02 f5 84 7f ac ac e4 6d e2 46 8c 2a f8 f0 be da |.......m.F.*....|
+Server Write key[16]:
+| 97 7f f7 90 55 ee 44 34 ba 01 e3 c5 73 33 4d b8 |....U.D4....s3M.|
+Client Write IV[16]:
+| b6 37 b5 a7 f3 3e ad 69 e9 9f 5d 32 d9 d7 02 2b |.7...>.i..]2...+|
+Server Write IV[16]:
+| 29 26 46 6f 70 87 c3 d2 d3 96 09 aa 04 c6 12 3a |)&Fop..........:|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 680
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 195
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 181, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 177 bytes, remaining 742
+ record: offset = 742, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 747 length 0 bytes, remaining 751
+
+dissect_ssl enter frame #428 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e2...
+looking for RSA pre-master41049356dc02ea9daa883eb1e070e91a3c9acef8fe2ab4e8...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 23 0e cc 7b 6e 87 b5 76 3b ab aa f1 28 c0 bd 1a |#..{n..v;...(...|
+| a2 65 68 7b 7d 84 50 6d 2f 5f 4a 2b ef d4 f8 a0 |.eh{}.Pm/_J+....|
+| 85 01 86 91 c9 f5 08 bd 0e 1a af 63 68 5a d5 04 |...........chZ..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f3 f8 5e 50 3f 39 bb b6 0e 91 46 5b 12 62 2d 25 |..^P?9....F[.b-%|
+| ae 6d 94 a0 09 83 23 9d 3f 3d 13 34 e5 52 34 c2 |.m....#.?=.4.R4.|
+| f3 5b c3 b6 25 01 5f 9e 96 5f 41 c8 85 c3 eb b8 |.[..%._.._A.....|
+| fb 55 9d f8 e2 43 bc 09 6a de 43 7e eb |.U...C..j.C~. |
+hash out[104]:
+| 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.|
+| 67 56 b9 21 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 |gV.!x..$.......f|
+| cb bd 67 e1 30 7b 83 e5 95 f7 f7 fb 87 6a af d2 |..g.0{.......j..|
+| 50 f6 79 04 85 57 75 d1 7d 7a 6d c8 db b2 a0 f3 |P.y..Wu.}zm.....|
+| ae 6e 1a 83 c8 01 2c 1e 5f 85 d4 54 2c a9 92 6b |.n....,._..T,..k|
+| a0 f5 69 85 bc 4c 40 70 ed 3c 1b 79 4c 13 47 e5 |..i..L@p.<.yL.G.|
+| cc 03 67 d7 7f 05 cc 9e |..g..... |
+PRF out[104]:
+| 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.|
+| 67 56 b9 21 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 |gV.!x..$.......f|
+| cb bd 67 e1 30 7b 83 e5 95 f7 f7 fb 87 6a af d2 |..g.0{.......j..|
+| 50 f6 79 04 85 57 75 d1 7d 7a 6d c8 db b2 a0 f3 |P.y..Wu.}zm.....|
+| ae 6e 1a 83 c8 01 2c 1e 5f 85 d4 54 2c a9 92 6b |.n....,._..T,..k|
+| a0 f5 69 85 bc 4c 40 70 ed 3c 1b 79 4c 13 47 e5 |..i..L@p.<.yL.G.|
+| cc 03 67 d7 7f 05 cc 9e |..g..... |
+key expansion[104]:
+| 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.|
+| 67 56 b9 21 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 |gV.!x..$.......f|
+| cb bd 67 e1 30 7b 83 e5 95 f7 f7 fb 87 6a af d2 |..g.0{.......j..|
+| 50 f6 79 04 85 57 75 d1 7d 7a 6d c8 db b2 a0 f3 |P.y..Wu.}zm.....|
+| ae 6e 1a 83 c8 01 2c 1e 5f 85 d4 54 2c a9 92 6b |.n....,._..T,..k|
+| a0 f5 69 85 bc 4c 40 70 ed 3c 1b 79 4c 13 47 e5 |..i..L@p.<.yL.G.|
+| cc 03 67 d7 7f 05 cc 9e |..g..... |
+Client MAC key[20]:
+| 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.|
+| 67 56 b9 21 |gV.! |
+Server MAC key[20]:
+| 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 cb bd 67 e1 |x..$.......f..g.|
+| 30 7b 83 e5 |0{.. |
+Client Write key[16]:
+| 95 f7 f7 fb 87 6a af d2 50 f6 79 04 85 57 75 d1 |.....j..P.y..Wu.|
+Server Write key[16]:
+| 7d 7a 6d c8 db b2 a0 f3 ae 6e 1a 83 c8 01 2c 1e |}zm......n....,.|
+Client Write IV[16]:
+| 5f 85 d4 54 2c a9 92 6b a0 f5 69 85 bc 4c 40 70 |_..T,..k..i..L@p|
+Server Write IV[16]:
+| ed 3c 1b 79 4c 13 47 e5 cc 03 67 d7 7f 05 cc 9e |.<.yL.G...g.....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 23 0e cc 7b 6e 87 b5 76 3b ab aa f1 28 c0 bd 1a |#..{n..v;...(...|
+| a2 65 68 7b 7d 84 50 6d 2f 5f 4a 2b ef d4 f8 a0 |.eh{}.Pm/_J+....|
+| 85 01 86 91 c9 f5 08 bd 0e 1a af 63 68 5a d5 04 |...........chZ..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b3 df 48 57 a7 b1 2b 05 44 62 c0 70 59 d8 20 63 |..HW..+.Db.pY. c|
+| 6c 61 9b b3 e9 dc 3e 4c d0 81 4b 0c e3 2f 5a 02 |la....>L..K../Z.|
+| ed 0b 73 f4 72 fe 1b f7 02 df ab 72 b0 a7 70 b0 |..s.r......r..p.|
+| dc 5f 67 10 88 97 a9 b1 15 1c cb ad 4a 04 9f a5 |._g.........J...|
+Plaintext[64]:
+| 2b dc a7 d7 d2 4f fc cb 1a ea 46 f1 73 22 cc 20 |+....O....F.s". |
+| 14 00 00 0c e4 0b 1f c5 ee 8c 34 ed ef d6 72 c0 |..........4...r.|
+| 34 65 bd 3a 3a 2e 7c c9 b5 12 a7 c8 27 7b 69 5f |4e.::.|.....'{i_|
+| 31 91 ac c2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |1...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 34 65 bd 3a 3a 2e 7c c9 b5 12 a7 c8 27 7b 69 5f |4e.::.|.....'{i_|
+| 31 91 ac c2 |1... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #429 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a3 a1 1a 86 92 3a 62 d3 f7 d5 b6 97 69 c9 87 c3 |.....:b.....i...|
+| 81 e6 df 4d 6a f4 fc ef b9 b2 b0 34 c7 0c e6 cc |...Mj......4....|
+| 0e 34 48 74 12 b9 a8 d2 4f 26 63 63 15 04 c8 be |.4Ht....O&cc....|
+| a8 f4 5e c3 ef a8 7a 91 7f 2d 25 e1 b8 33 b0 5d |..^...z..-%..3.]|
+Plaintext[64]:
+| 74 a1 d0 84 57 46 d5 15 06 08 c6 c4 9d e5 cd f4 |t...WF..........|
+| 14 00 00 0c b0 97 31 68 da 44 50 21 ad 97 71 c0 |......1h.DP!..q.|
+| 28 c8 12 6f b6 18 2d 5b a6 25 5a 88 da 12 ad 61 |(..o..-[.%Z....a|
+| d1 8a 10 e2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 28 c8 12 6f b6 18 2d 5b a6 25 5a 88 da 12 ad 61 |(..o..-[.%Z....a|
+| d1 8a 10 e2 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #430 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 00 d9 1f ae ed ee 14 33 67 ce b4 c1 03 50 c2 5d |.......3g....P.]|
+| 0b 23 1e ac 1b fc a2 10 27 4d f3 bf 6b ab 97 4e |.#......'M..k..N|
+| 19 3e 88 08 bb e7 24 40 a1 06 16 86 fa 69 b3 68 |.>....$@.....i.h|
+| 38 61 e9 51 90 a3 e3 d1 5c bd 74 0d a3 f2 e0 ef |8a.Q....\.t.....|
+| e9 4a eb 52 e9 c9 bf d6 a7 06 f3 8f 47 20 19 28 |.J.R........G .(|
+| 59 91 36 60 ff 72 fb 09 c5 34 2a 51 0e 11 f9 a9 |Y.6`.r...4*Q....|
+| f2 96 5c af 43 94 8a 2f bb a8 cf 07 90 12 f2 39 |..\.C../.......9|
+| 40 ce 9c 41 e7 b1 52 35 46 4d 0d d4 a5 7d 4e 94 |@..A..R5FM...}N.|
+Plaintext[128]:
+| c3 0c 6a 2e 6e 5e 03 02 2a d4 28 64 f6 63 3a 53 |..j.n^..*.(d.c:S|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a b0 b2 70 a6 |.nl:4485......p.|
+| 3d 3a cd 4f 8f c8 b4 c0 25 53 01 bb 46 b5 78 79 |=:.O....%S..F.xy|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 112
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 81 40 3d 40 04 66 3f 8b 8f cc 60 d4 c7 4a 12 fe |.@=@.f?...`..J..|
+| 6d 54 3a 72 |mT:r |
+ssl_decrypt_record: mac failed
+association_find: TCP port 39714 found (nil)
+association_find: TCP port 4485 found 0x37382a0
+
+dissect_ssl enter frame #431 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 10 a3 0c 90 b6 a0 9e d2 2d 7d c2 d4 6a be 21 a9 |........-}..j.!.|
+| 98 f4 93 1d e5 44 b5 7c 32 1b c5 9a 1a e8 f9 85 |.....D.|2.......|
+| dd 1d 69 f9 98 c2 1b 53 15 6c c2 7f 37 5b fa be |..i....S.l..7[..|
+| d3 84 5f 1b 91 4c da 8b cd 62 c6 7e a5 8b 67 4e |.._..L...b.~..gN|
+| 47 64 4f 59 f8 4b 40 92 98 68 c1 60 23 e6 e6 a9 |GdOY.K@..h.`#...|
+| 5c 3a 46 64 55 df 66 48 4b 5c c2 9a 0e 49 a7 1f |\:FdU.fHK\...I..|
+| b6 b4 e8 53 72 31 1c b3 8a f5 ac 9f 55 05 21 0e |...Sr1......U.!.|
+| e2 84 9a e3 39 09 7c a6 b8 1a e6 60 28 bf 10 cd |....9.|....`(...|
+| 9a 14 2b 10 ed 2c 05 42 ae 80 cf 31 b7 de 32 0a |..+..,.B...1..2.|
+| f4 03 d7 37 05 3f cb 06 79 cb 22 f1 cc 17 da 28 |...7.?..y."....(|
+| 36 bc 0f 2a 6a 74 cc 0b 8a ae 5d 49 92 e4 ae 1f |6..*jt....]I....|
+| a2 7a 4a d4 a6 05 9d d1 2f 00 64 ab a2 bd 02 fe |.zJ...../.d.....|
+| c7 27 8b fd 86 42 04 4d e2 4f 2c 98 8f a2 10 46 |.'...B.M.O,....F|
+| a3 e9 3d c1 81 9e 00 b2 4e 2a 75 88 9f 38 5e 46 |..=.....N*u..8^F|
+| 52 ea ae 0d c7 b4 92 69 d5 ed 60 d9 a4 3e 87 db |R......i..`..>..|
+| 38 99 59 51 f6 01 95 fa 30 d1 aa 84 31 e5 25 5d |8.YQ....0...1.%]|
+| 3d fd 69 44 32 65 ee 8e db 14 f9 21 95 b0 17 5b |=.iD2e.....!...[|
+| da bd a0 73 c4 d3 84 b3 56 f1 37 e9 30 77 dd d5 |...s....V.7.0w..|
+| 17 6a f8 2b ff c5 ca e8 e5 f3 24 87 a3 58 1e b4 |.j.+......$..X..|
+| 3f f3 74 93 f4 f0 d7 28 91 13 43 d9 a5 a1 70 ba |?.t....(..C...p.|
+| 05 16 f9 9b 87 ca 9b 41 bb 67 fd 23 3b 33 6f d4 |.......A.g.#;3o.|
+| a5 86 76 d5 0f fc 38 bb 32 d7 2c de 2e 10 f7 a7 |..v...8.2.,.....|
+| a6 ea 4d fa 83 fd 56 ad 61 86 82 fe 56 91 b9 ea |..M...V.a...V...|
+| 50 1c 32 20 f3 f3 eb 73 54 fd e3 5f 26 f6 74 3b |P.2 ...sT.._&.t;|
+| f7 36 10 c0 72 10 c9 55 0d 0a 38 e2 f1 be 52 ec |.6..r..U..8...R.|
+Plaintext[400]:
+| fb 7d cd 3a d1 29 53 63 c9 70 4e fe 0d eb 48 80 |.}.:.)Sc.pN...H.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:31 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 52 34 f3 |.nl'</script>R4.|
+| 7c 47 4e 8a 4f 9b 27 53 25 4f 25 da b0 df e6 19 ||GN.O.'S%O%.....|
+| ee 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 385
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6b 25 04 aa c0 47 c5 4c af 6b 24 2d 55 97 94 38 |k%...G.L.k$-U..8|
+| c0 37 b7 3f |.7.? |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4485 found 0x37382a0
+
+dissect_ssl enter frame #432 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2a 90 3f 69 36 f5 12 b4 e7 d6 94 6a 56 28 26 fb |*.?i6......jV(&.|
+| 53 90 29 d0 7e 34 d1 08 0f 1c 52 67 ed e2 ae e3 |S.).~4....Rg....|
+| 31 e6 0d 6e 8c 61 40 5b b8 c7 6c ac 11 7d 9d c4 |1..n.a@[..l..}..|
+Plaintext[48]:
+| 67 94 f8 ad 1e cb 6d 1c 60 ae 83 11 6c f3 72 9e |g.....m.`...l.r.|
+| 01 00 3e 1f 90 57 87 4b 51 b2 ce 18 3e f9 38 8b |..>..W.KQ...>.8.|
+| d6 71 40 d0 06 6c 09 09 09 09 09 09 09 09 09 09 |.q@..l..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e 1f 90 57 87 4b 51 b2 ce 18 3e f9 38 8b d6 71 |>..W.KQ...>.8..q|
+| 40 d0 06 6c |@..l |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #434 (first time)
+ conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 0e f7 64 f1 ff d0 7b 67 8c 82 7c ca 28 94 88 75 |..d...{g..|.(..u|
+| 5d 4c 16 dd 78 77 7c aa 8a 52 d7 65 9f 42 69 f7 |]L..xw|..R.e.Bi.|
+| e2 28 fa 2b 05 76 7c 2c 4f 1c 41 7b 3b da c9 7f |.(.+.v|,O.A{;...|
+Plaintext[48]:
+| 33 d0 74 37 ef 30 dd ba 4f d0 ec 93 64 fa 7a d4 |3.t7.0..O...d.z.|
+| 01 00 73 c1 43 28 0c 95 f5 8c 44 6f 10 bd ad c3 |..s.C(....Do....|
+| 74 01 41 2e ea 94 09 09 09 09 09 09 09 09 09 09 |t.A.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 73 c1 43 28 0c 95 f5 8c 44 6f 10 bd ad c3 74 01 |s.C(....Do....t.|
+| 41 2e ea 94 |A... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #439 (first time)
+ssl_session_init: initializing ptr 0x7fca45c0a1c0 size 688
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 48250 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4486
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #441 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 751
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 23 0e cc 7b 6e 87 b5 76 3b ab aa f1 28 c0 bd 1a |#..{n..v;...(...|
+| a2 65 68 7b 7d 84 50 6d 2f 5f 4a 2b ef d4 f8 a0 |.eh{}.Pm/_J+....|
+| 85 01 86 91 c9 f5 08 bd 0e 1a af 63 68 5a d5 04 |...........chZ..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 7e dd e6 12 4f 5d a4 03 a7 60 cd 35 f7 2f 8c |.~...O]...`.5./.|
+| 55 c6 29 87 6f 7d 8e 06 29 8f da 9d 5f 52 34 c2 |U.).o}..)..._R4.|
+| f4 4e fc 1d 6a b6 a3 e3 40 b5 71 61 5b 38 e0 5a |.N..j...@.qa[8.Z|
+| b4 b2 c9 9c 13 36 91 7f eb 5d c4 56 30 |.....6...].V0 |
+hash out[136]:
+| 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.|
+| 3e e0 a5 61 5f fe a8 11 da 4e 26 c2 68 b3 97 9e |>..a_....N&.h...|
+| 6d 7c 52 d0 e6 7b 53 61 b5 8c 08 4d 58 42 ac 18 |m|R..{Sa...MXB..|
+| 63 10 4c cc e5 4a 79 5d bc 30 69 a4 56 ae c2 4e |c.L..Jy].0i.V..N|
+| 63 aa 4a 91 16 86 23 cc ee ce 83 b6 ad 00 fb 6e |c.J...#........n|
+| 7e 2c 6c ce 09 c4 d2 a2 25 1f 1e 3c fd 78 61 6b |~,l.....%..<.xak|
+| 12 bc f1 b5 ad 0d 35 43 c7 a1 49 2e ff 61 3c 0f |......5C..I..a<.|
+| 90 8a 95 3c e6 18 70 c5 3d 01 c9 a1 5f 65 b4 0a |...<..p.=..._e..|
+| 7e f7 73 b3 36 74 e0 f7 |~.s.6t.. |
+PRF out[136]:
+| 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.|
+| 3e e0 a5 61 5f fe a8 11 da 4e 26 c2 68 b3 97 9e |>..a_....N&.h...|
+| 6d 7c 52 d0 e6 7b 53 61 b5 8c 08 4d 58 42 ac 18 |m|R..{Sa...MXB..|
+| 63 10 4c cc e5 4a 79 5d bc 30 69 a4 56 ae c2 4e |c.L..Jy].0i.V..N|
+| 63 aa 4a 91 16 86 23 cc ee ce 83 b6 ad 00 fb 6e |c.J...#........n|
+| 7e 2c 6c ce 09 c4 d2 a2 25 1f 1e 3c fd 78 61 6b |~,l.....%..<.xak|
+| 12 bc f1 b5 ad 0d 35 43 c7 a1 49 2e ff 61 3c 0f |......5C..I..a<.|
+| 90 8a 95 3c e6 18 70 c5 3d 01 c9 a1 5f 65 b4 0a |...<..p.=..._e..|
+| 7e f7 73 b3 36 74 e0 f7 |~.s.6t.. |
+key expansion[136]:
+| 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.|
+| 3e e0 a5 61 5f fe a8 11 da 4e 26 c2 68 b3 97 9e |>..a_....N&.h...|
+| 6d 7c 52 d0 e6 7b 53 61 b5 8c 08 4d 58 42 ac 18 |m|R..{Sa...MXB..|
+| 63 10 4c cc e5 4a 79 5d bc 30 69 a4 56 ae c2 4e |c.L..Jy].0i.V..N|
+| 63 aa 4a 91 16 86 23 cc ee ce 83 b6 ad 00 fb 6e |c.J...#........n|
+| 7e 2c 6c ce 09 c4 d2 a2 25 1f 1e 3c fd 78 61 6b |~,l.....%..<.xak|
+| 12 bc f1 b5 ad 0d 35 43 c7 a1 49 2e ff 61 3c 0f |......5C..I..a<.|
+| 90 8a 95 3c e6 18 70 c5 3d 01 c9 a1 5f 65 b4 0a |...<..p.=..._e..|
+| 7e f7 73 b3 36 74 e0 f7 |~.s.6t.. |
+Client MAC key[20]:
+| 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.|
+| 3e e0 a5 61 |>..a |
+Server MAC key[20]:
+| 5f fe a8 11 da 4e 26 c2 68 b3 97 9e 6d 7c 52 d0 |_....N&.h...m|R.|
+| e6 7b 53 61 |.{Sa |
+Client Write key[32]:
+| b5 8c 08 4d 58 42 ac 18 63 10 4c cc e5 4a 79 5d |...MXB..c.L..Jy]|
+| bc 30 69 a4 56 ae c2 4e 63 aa 4a 91 16 86 23 cc |.0i.V..Nc.J...#.|
+Server Write key[32]:
+| ee ce 83 b6 ad 00 fb 6e 7e 2c 6c ce 09 c4 d2 a2 |.......n~,l.....|
+| 25 1f 1e 3c fd 78 61 6b 12 bc f1 b5 ad 0d 35 43 |%..<.xak......5C|
+Client Write IV[16]:
+| c7 a1 49 2e ff 61 3c 0f 90 8a 95 3c e6 18 70 c5 |..I..a<....<..p.|
+Server Write IV[16]:
+| 3d 01 c9 a1 5f 65 b4 0a 7e f7 73 b3 36 74 e0 f7 |=..._e..~.s.6t..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 680
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 195
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 181, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 177 bytes, remaining 742
+ record: offset = 742, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 747 length 0 bytes, remaining 751
+
+dissect_ssl enter frame #443 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c13...
+looking for RSA pre-master4104a359eccc41af2ee300098d0ec449f8da856806ee6f69...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3b c8 4e 24 9b e1 08 c6 1e 0e 39 4d 2a d1 ec 11 |;.N$......9M*...|
+| 3d 3c d8 21 20 97 7d 38 be 08 af de b5 71 66 e1 |=<.! .}8.....qf.|
+| 6f c2 8f 55 bd e3 a1 99 8d 58 e0 d5 79 20 1f 4f |o..U.....X..y .O|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 7e dd e6 12 4f 5d a4 03 a7 60 cd 35 f7 2f 8c |.~...O]...`.5./.|
+| 55 c6 29 87 6f 7d 8e 06 29 8f da 9d 5f 52 34 c2 |U.).o}..)..._R4.|
+| f4 4e fc 1d 6a b6 a3 e3 40 b5 71 61 5b 38 e0 5a |.N..j...@.qa[8.Z|
+| b4 b2 c9 9c 13 36 91 7f eb 5d c4 56 30 |.....6...].V0 |
+hash out[136]:
+| 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......|
+| c8 5d d9 13 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 |.]..j...........|
+| e1 e0 92 1d 85 51 1c 5f 37 c2 a3 d9 8b 9f 50 94 |.....Q._7.....P.|
+| fe 0d 0d 42 e1 cc c0 a2 1b 3e 78 1c 74 4d 3f 5e |...B.....>x.tM?^|
+| d6 da 3b 21 55 70 c5 e1 f8 01 2c c9 b8 a6 70 1c |..;!Up....,...p.|
+| 47 ee 3d ee d3 12 34 1a 59 eb d2 9d a8 c9 e1 2e |G.=...4.Y.......|
+| 32 b5 ac 04 d7 07 20 02 cc b5 f4 3d e4 cc a5 4c |2..... ....=...L|
+| f2 2a be 49 41 51 c9 7d 3f 8f 3c ee b3 3b 0f d5 |.*.IAQ.}?.<..;..|
+| e9 f0 27 67 df 25 37 24 |..'g.%7$ |
+PRF out[136]:
+| 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......|
+| c8 5d d9 13 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 |.]..j...........|
+| e1 e0 92 1d 85 51 1c 5f 37 c2 a3 d9 8b 9f 50 94 |.....Q._7.....P.|
+| fe 0d 0d 42 e1 cc c0 a2 1b 3e 78 1c 74 4d 3f 5e |...B.....>x.tM?^|
+| d6 da 3b 21 55 70 c5 e1 f8 01 2c c9 b8 a6 70 1c |..;!Up....,...p.|
+| 47 ee 3d ee d3 12 34 1a 59 eb d2 9d a8 c9 e1 2e |G.=...4.Y.......|
+| 32 b5 ac 04 d7 07 20 02 cc b5 f4 3d e4 cc a5 4c |2..... ....=...L|
+| f2 2a be 49 41 51 c9 7d 3f 8f 3c ee b3 3b 0f d5 |.*.IAQ.}?.<..;..|
+| e9 f0 27 67 df 25 37 24 |..'g.%7$ |
+key expansion[136]:
+| 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......|
+| c8 5d d9 13 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 |.]..j...........|
+| e1 e0 92 1d 85 51 1c 5f 37 c2 a3 d9 8b 9f 50 94 |.....Q._7.....P.|
+| fe 0d 0d 42 e1 cc c0 a2 1b 3e 78 1c 74 4d 3f 5e |...B.....>x.tM?^|
+| d6 da 3b 21 55 70 c5 e1 f8 01 2c c9 b8 a6 70 1c |..;!Up....,...p.|
+| 47 ee 3d ee d3 12 34 1a 59 eb d2 9d a8 c9 e1 2e |G.=...4.Y.......|
+| 32 b5 ac 04 d7 07 20 02 cc b5 f4 3d e4 cc a5 4c |2..... ....=...L|
+| f2 2a be 49 41 51 c9 7d 3f 8f 3c ee b3 3b 0f d5 |.*.IAQ.}?.<..;..|
+| e9 f0 27 67 df 25 37 24 |..'g.%7$ |
+Client MAC key[20]:
+| 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......|
+| c8 5d d9 13 |.].. |
+Server MAC key[20]:
+| 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 e1 e0 92 1d |j...............|
+| 85 51 1c 5f |.Q._ |
+Client Write key[32]:
+| 37 c2 a3 d9 8b 9f 50 94 fe 0d 0d 42 e1 cc c0 a2 |7.....P....B....|
+| 1b 3e 78 1c 74 4d 3f 5e d6 da 3b 21 55 70 c5 e1 |.>x.tM?^..;!Up..|
+Server Write key[32]:
+| f8 01 2c c9 b8 a6 70 1c 47 ee 3d ee d3 12 34 1a |..,...p.G.=...4.|
+| 59 eb d2 9d a8 c9 e1 2e 32 b5 ac 04 d7 07 20 02 |Y.......2..... .|
+Client Write IV[16]:
+| cc b5 f4 3d e4 cc a5 4c f2 2a be 49 41 51 c9 7d |...=...L.*.IAQ.}|
+Server Write IV[16]:
+| 3f 8f 3c ee b3 3b 0f d5 e9 f0 27 67 df 25 37 24 |?.<..;....'g.%7$|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3b c8 4e 24 9b e1 08 c6 1e 0e 39 4d 2a d1 ec 11 |;.N$......9M*...|
+| 3d 3c d8 21 20 97 7d 38 be 08 af de b5 71 66 e1 |=<.! .}8.....qf.|
+| 6f c2 8f 55 bd e3 a1 99 8d 58 e0 d5 79 20 1f 4f |o..U.....X..y .O|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 7f 8f e3 35 ab 81 d4 1f f4 b3 8c c8 8e 11 04 6a |...5...........j|
+| 40 0b 5c 91 fa f3 5e 63 bb 2f 4d 2c 3c cb a1 ac |@.\...^c./M,<...|
+| 9e f1 28 bc cc 2e bd 5a 33 74 a7 0e 6d ed de bd |..(....Z3t..m...|
+| bb 77 c5 d3 69 42 e7 47 ef 03 e0 2d 74 f8 21 f5 |.w..iB.G...-t.!.|
+Plaintext[64]:
+| 48 91 ef 44 f2 9c c8 87 27 53 4e a5 71 74 26 bc |H..D....'SN.qt&.|
+| 14 00 00 0c f6 9c b2 18 ec 38 5c a3 7b 05 53 aa |.........8\.{.S.|
+| 31 7e 26 ee 0a 82 3c 62 f4 72 fb fd ce b2 5b 4b |1~&...<b.r....[K|
+| 79 8b 76 09 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |y.v.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 7e 26 ee 0a 82 3c 62 f4 72 fb fd ce b2 5b 4b |1~&...<b.r....[K|
+| 79 8b 76 09 |y.v. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #444 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| e1 17 3e 83 68 55 fc a2 91 f5 e8 50 eb f3 0e 5a |..>.hU.....P...Z|
+| 6e 89 63 a2 8c 90 01 18 f6 1a 72 f1 1c 5a ae b3 |n.c.......r..Z..|
+| 92 4e 7f a8 03 8b e0 c4 2a 4d e1 19 be a0 1a 47 |.N......*M.....G|
+| db ea ec ba 59 73 a4 75 36 0c cc 82 0d 4e 6d fd |....Ys.u6....Nm.|
+Plaintext[64]:
+| c7 50 05 fa 14 d3 66 c9 b5 8f f4 cd 99 58 a5 8b |.P....f......X..|
+| 14 00 00 0c 12 55 8f 22 af 9a a2 f2 2d 72 84 02 |.....U."....-r..|
+| e4 ff 8b 9c ae eb ca 16 07 f6 07 19 10 a6 c8 41 |...............A|
+| 6d 18 26 f8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m.&.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e4 ff 8b 9c ae eb ca 16 07 f6 07 19 10 a6 c8 41 |...............A|
+| 6d 18 26 f8 |m.&. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #445 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| ec 62 b5 e1 46 0f fb 51 15 bc a4 8d ef e0 ba b4 |.b..F..Q........|
+| ce 03 3a 66 d0 fa c2 c5 5a 46 dd da c2 f9 3c 29 |..:f....ZF....<)|
+| fc dd 1a b8 2d 61 9f 50 3c 60 57 15 ea 54 ce 11 |....-a.P<`W..T..|
+| d0 d3 ba 5e 40 d7 e5 99 a8 aa 66 1c 56 22 37 fa |...^@.....f.V"7.|
+| d6 45 76 41 20 44 7a 00 a0 d5 af 45 1a 80 2b 3f |.EvA Dz....E..+?|
+| 73 f7 88 4e 37 57 7d bb 9e a4 ee b2 62 e1 62 40 |s..N7W}.....b.b@|
+| 47 f0 53 52 d1 61 5f 7e e9 17 a9 47 84 37 af a8 |G.SR.a_~...G.7..|
+| 23 2d 8e 15 59 8a 93 8d 61 6c b4 6a 85 f9 c7 8d |#-..Y...al.j....|
+Plaintext[128]:
+| 2e 93 43 b2 95 e2 e9 e6 bb 8d 5b 7d 60 82 06 84 |..C.......[}`...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a 77 b2 66 d7 |.nl:4486....w.f.|
+| ab 32 91 72 b7 3c 10 aa 38 50 01 26 39 ff c0 46 |.2.r.<..8P.&9..F|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 112
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6a ae 68 0c f2 18 5e ac c2 e5 c4 11 d6 43 51 a1 |j.h...^......CQ.|
+| 39 6a 49 11 |9jI. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 48250 found (nil)
+association_find: TCP port 4486 found 0x3738330
+
+dissect_ssl enter frame #446 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 80 16 90 4d d9 67 50 88 eb dc 61 30 c8 bd 01 f9 |...M.gP...a0....|
+| 56 de 6d 5d 20 03 94 4c bf 01 88 f8 73 4a d3 98 |V.m] ..L....sJ..|
+| 2c 17 d2 7b 43 a4 a4 70 86 74 80 aa 3b 2b 3a 24 |,..{C..p.t..;+:$|
+| 10 1e 1d 97 84 bf 6b 55 16 dd 02 93 eb 2e 90 72 |......kU.......r|
+| c6 a0 77 4c 7e 0c 05 ac 6e 5c 88 7f 2d 91 04 95 |..wL~...n\..-...|
+| dc 4b 8d d7 15 d1 15 6b 47 95 be 2b 62 84 28 fc |.K.....kG..+b.(.|
+| 36 85 8d e5 17 6b ba cc 68 ee ce 56 46 a5 f8 2c |6....k..h..VF..,|
+| 9f a6 17 93 95 03 7e 06 54 bb 03 f4 d1 5c 35 45 |......~.T....\5E|
+| f1 de 85 23 0f 9d 1d 38 4a 52 7e 6a 7e 78 4e ff |...#...8JR~j~xN.|
+| 38 e4 de 4e b0 0c a7 72 3b ad f7 f1 bb af 7a cb |8..N...r;.....z.|
+| b9 d5 f7 a2 09 cb d7 6e ec 70 76 10 17 ca 20 55 |.......n.pv... U|
+| a7 6b 9e 1b f8 57 26 a2 cb 85 41 13 ed dd aa 4d |.k...W&...A....M|
+| c8 84 d0 61 a2 d4 e4 28 1e 81 ba 25 53 59 3d 27 |...a...(...%SY='|
+| 54 7b 7f c0 c9 d4 a9 84 71 b8 9b 5e 9b a3 fa 63 |T{......q..^...c|
+| 23 b9 34 74 62 b2 e6 48 bd 4c 31 4d 81 01 09 ec |#.4tb..H.L1M....|
+| ee be a3 17 9c 7c a9 7e 54 8a 60 b3 12 ca ea 61 |.....|.~T.`....a|
+| 7d 57 4c 8e bd 5e 31 5c 6d e6 13 de 60 2c 11 50 |}WL..^1\m...`,.P|
+| f4 1d 3c 32 e9 02 cb d5 55 a0 26 2f 6a a0 51 bb |..<2....U.&/j.Q.|
+| 8f 7b d1 5b 75 76 18 25 f8 70 da f5 41 59 3a 01 |.{.[uv.%.p..AY:.|
+| a1 ce 52 3c 3a bc d1 0c bc 86 10 3f 03 7b e7 f6 |..R<:......?.{..|
+| 37 b1 87 94 24 0c 95 93 77 7a a1 bb dd e9 88 98 |7...$...wz......|
+| 15 fb c5 7b 17 5e 2d a6 b5 d2 a8 39 b7 2f 36 6c |...{.^-....9./6l|
+| 65 cc ea be ae b6 05 68 5f 88 a8 fa 74 04 72 49 |e......h_...t.rI|
+| d5 0c ff a6 b5 42 c5 38 ec ef 64 98 87 77 70 9a |.....B.8..d..wp.|
+| 63 0c e2 68 c7 d6 72 6b 08 cd 27 92 fd 99 d1 63 |c..h..rk..'....c|
+Plaintext[400]:
+| 81 a4 a3 7a 99 1f e7 ad 53 c5 b4 24 fb 50 3b 00 |...z....S..$.P;.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:32 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ba 44 51 |.nl'</script>.DQ|
+| 4e 2f 6e c9 53 d7 dd f1 7d 20 40 52 62 0f 4b 21 |N/n.S...} @Rb.K!|
+| 32 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |2...............|
+ssl_decrypt_record found padding 14 final len 385
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 77 19 96 15 26 08 42 16 87 10 8a d2 b5 17 57 16 |w...&.B.......W.|
+| df 66 36 96 |.f6. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4486 found 0x3738330
+
+dissect_ssl enter frame #447 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b7 21 55 93 96 0b f7 d5 45 43 0d e0 39 3d 56 8e |.!U.....EC..9=V.|
+| 56 08 a8 af 14 15 7a 43 da 20 22 27 7d 33 45 66 |V.....zC. "'}3Ef|
+| f0 ba 8b 71 a3 37 91 82 f5 da 7c c9 8f 3d d7 a9 |...q.7....|..=..|
+Plaintext[48]:
+| 1a 16 9b 3f 11 ea 3f 6e 37 2f c0 10 d5 2e 90 1b |...?..?n7/......|
+| 01 00 ad 29 78 5b 99 79 4b 94 d4 f4 3e 8d c6 fa |...)x[.yK...>...|
+| fa 68 0e 66 92 a9 09 09 09 09 09 09 09 09 09 09 |.h.f............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ad 29 78 5b 99 79 4b 94 d4 f4 3e 8d c6 fa fa 68 |.)x[.yK...>....h|
+| 0e 66 92 a9 |.f.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #449 (first time)
+ conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 86 dc 96 1b a4 2a bb 3e a4 65 62 d9 84 d9 c2 98 |.....*.>.eb.....|
+| a0 68 7b 6d 57 40 65 84 f4 a8 89 d8 10 5f 2e 3d |.h{mW@e......_.=|
+| bc e8 f3 a3 c7 d3 6e b2 6e c8 19 cf 85 66 10 8d |......n.n....f..|
+Plaintext[48]:
+| 49 f4 df 58 0f 21 4c b8 38 40 cd 19 0f 3d 83 5d |I..X.!L.8@...=.]|
+| 01 00 4f a4 a7 57 7f c1 e7 16 a1 ba 24 83 4a 75 |..O..W......$.Ju|
+| c6 af e3 66 f2 7c 09 09 09 09 09 09 09 09 09 09 |...f.|..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4f a4 a7 57 7f c1 e7 16 a1 ba 24 83 4a 75 c6 af |O..W......$.Ju..|
+| e3 66 f2 7c |.f.| |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #454 (first time)
+ssl_session_init: initializing ptr 0x7fca45c0c680 size 688
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34675 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4492
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #456 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3b c8 4e 24 9b e1 08 c6 1e 0e 39 4d 2a d1 ec 11 |;.N$......9M*...|
+| 3d 3c d8 21 20 97 7d 38 be 08 af de b5 71 66 e1 |=<.! .}8.....qf.|
+| 6f c2 8f 55 bd e3 a1 99 8d 58 e0 d5 79 20 1f 4f |o..U.....X..y .O|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 ce 92 33 b8 9d d4 aa 17 6a 84 fb 68 66 8e af |...3.....j..hf..|
+| ad 9e 37 a8 0a 0a e9 c2 89 19 7e 5f 78 52 34 c2 |..7.......~_xR4.|
+| f4 0f 4c c7 06 7b 7a 2e 51 06 ed a1 99 e8 50 e1 |..L..{z.Q.....P.|
+| 5f 08 5a 6d 2d 85 e7 55 e3 ee b0 3b 5e |_.Zm-..U...;^ |
+hash out[104]:
+| 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.|
+| 01 b6 fa e8 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 |....xE.../..*..t|
+| 2b 4d 38 9a a3 ea 07 71 e3 c1 f8 fc 2f 81 55 62 |+M8....q..../.Ub|
+| 89 90 87 07 61 ad 63 e8 71 9a cb d4 52 2c ed 89 |....a.c.q...R,..|
+| 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.|
+| 32 a3 9c 94 3a f4 f2 fa 67 12 b1 21 33 40 56 09 |2...:...g..!3@V.|
+| cf 9b 27 41 6d 2b c1 25 |..'Am+.% |
+PRF out[104]:
+| 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.|
+| 01 b6 fa e8 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 |....xE.../..*..t|
+| 2b 4d 38 9a a3 ea 07 71 e3 c1 f8 fc 2f 81 55 62 |+M8....q..../.Ub|
+| 89 90 87 07 61 ad 63 e8 71 9a cb d4 52 2c ed 89 |....a.c.q...R,..|
+| 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.|
+| 32 a3 9c 94 3a f4 f2 fa 67 12 b1 21 33 40 56 09 |2...:...g..!3@V.|
+| cf 9b 27 41 6d 2b c1 25 |..'Am+.% |
+key expansion[104]:
+| 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.|
+| 01 b6 fa e8 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 |....xE.../..*..t|
+| 2b 4d 38 9a a3 ea 07 71 e3 c1 f8 fc 2f 81 55 62 |+M8....q..../.Ub|
+| 89 90 87 07 61 ad 63 e8 71 9a cb d4 52 2c ed 89 |....a.c.q...R,..|
+| 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.|
+| 32 a3 9c 94 3a f4 f2 fa 67 12 b1 21 33 40 56 09 |2...:...g..!3@V.|
+| cf 9b 27 41 6d 2b c1 25 |..'Am+.% |
+Client MAC key[20]:
+| 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.|
+| 01 b6 fa e8 |.... |
+Server MAC key[20]:
+| 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 2b 4d 38 9a |xE.../..*..t+M8.|
+| a3 ea 07 71 |...q |
+Client Write key[24]:
+| e3 c1 f8 fc 2f 81 55 62 89 90 87 07 61 ad 63 e8 |..../.Ub....a.c.|
+| 71 9a cb d4 52 2c ed 89 |q...R,.. |
+Server Write key[24]:
+| 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.|
+| 32 a3 9c 94 3a f4 f2 fa |2...:... |
+Client Write IV[8]:
+| 67 12 b1 21 33 40 56 09 |g..!3@V. |
+Server Write IV[8]:
+| cf 9b 27 41 6d 2b c1 25 |..'Am+.% |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #458 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d...
+looking for RSA pre-master410478754e69dfa147c2c03c970d182a3bd0b3a18dc30f6d...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 bf 45 46 07 a5 87 7c 96 9e 98 76 be c3 12 89 |@.EF...|...v....|
+| ea 11 3c 08 73 b4 a1 6c 12 9b 0f 71 7c 56 0a dc |..<.s..l...q|V..|
+| b5 43 a4 0f 46 3e c1 cd 62 3a f9 84 7e d1 50 4e |.C..F>..b:..~.PN|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 ce 92 33 b8 9d d4 aa 17 6a 84 fb 68 66 8e af |...3.....j..hf..|
+| ad 9e 37 a8 0a 0a e9 c2 89 19 7e 5f 78 52 34 c2 |..7.......~_xR4.|
+| f4 0f 4c c7 06 7b 7a 2e 51 06 ed a1 99 e8 50 e1 |..L..{z.Q.....P.|
+| 5f 08 5a 6d 2d 85 e7 55 e3 ee b0 3b 5e |_.Zm-..U...;^ |
+hash out[104]:
+| 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....|
+| ec 63 67 e2 de 76 8b 33 f5 02 0e cb 92 a7 da 4e |.cg..v.3.......N|
+| f0 ad ab 97 63 ac c1 9b c3 b3 bc 9e 58 0a 86 aa |....c.......X...|
+| c2 ff a2 75 da 9c 9d d0 98 88 1a 25 3e b5 47 63 |...u.......%>.Gc|
+| 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..|
+| 8c 1e 09 25 fa b1 4f b1 ec 73 62 96 56 61 6d 71 |...%..O..sb.Vamq|
+| 12 b3 1c 19 79 20 b0 2a |....y .* |
+PRF out[104]:
+| 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....|
+| ec 63 67 e2 de 76 8b 33 f5 02 0e cb 92 a7 da 4e |.cg..v.3.......N|
+| f0 ad ab 97 63 ac c1 9b c3 b3 bc 9e 58 0a 86 aa |....c.......X...|
+| c2 ff a2 75 da 9c 9d d0 98 88 1a 25 3e b5 47 63 |...u.......%>.Gc|
+| 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..|
+| 8c 1e 09 25 fa b1 4f b1 ec 73 62 96 56 61 6d 71 |...%..O..sb.Vamq|
+| 12 b3 1c 19 79 20 b0 2a |....y .* |
+key expansion[104]:
+| 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....|
+| ec 63 67 e2 de 76 8b 33 f5 02 0e cb 92 a7 da 4e |.cg..v.3.......N|
+| f0 ad ab 97 63 ac c1 9b c3 b3 bc 9e 58 0a 86 aa |....c.......X...|
+| c2 ff a2 75 da 9c 9d d0 98 88 1a 25 3e b5 47 63 |...u.......%>.Gc|
+| 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..|
+| 8c 1e 09 25 fa b1 4f b1 ec 73 62 96 56 61 6d 71 |...%..O..sb.Vamq|
+| 12 b3 1c 19 79 20 b0 2a |....y .* |
+Client MAC key[20]:
+| 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....|
+| ec 63 67 e2 |.cg. |
+Server MAC key[20]:
+| de 76 8b 33 f5 02 0e cb 92 a7 da 4e f0 ad ab 97 |.v.3.......N....|
+| 63 ac c1 9b |c... |
+Client Write key[24]:
+| c3 b3 bc 9e 58 0a 86 aa c2 ff a2 75 da 9c 9d d0 |....X......u....|
+| 98 88 1a 25 3e b5 47 63 |...%>.Gc |
+Server Write key[24]:
+| 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..|
+| 8c 1e 09 25 fa b1 4f b1 |...%..O. |
+Client Write IV[8]:
+| ec 73 62 96 56 61 6d 71 |.sb.Vamq |
+Server Write IV[8]:
+| 12 b3 1c 19 79 20 b0 2a |....y .* |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 40 bf 45 46 07 a5 87 7c 96 9e 98 76 be c3 12 89 |@.EF...|...v....|
+| ea 11 3c 08 73 b4 a1 6c 12 9b 0f 71 7c 56 0a dc |..<.s..l...q|V..|
+| b5 43 a4 0f 46 3e c1 cd 62 3a f9 84 7e d1 50 4e |.C..F>..b:..~.PN|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e6 50 31 95 fe fb 11 a9 e7 07 72 e8 03 8f fd 9a |.P1.......r.....|
+| 35 30 2a 63 ca cb cc fa 1a 90 9e 43 8b 43 d2 e4 |50*c.......C.C..|
+| 89 1d 86 d8 31 7b b0 f9 ef 11 d0 9e 65 92 a6 59 |....1{......e..Y|
+Plaintext[48]:
+| ac d8 fc e7 68 d7 ee 28 14 00 00 0c 32 2e 24 db |....h..(....2.$.|
+| 9c e0 6a e1 cd 90 9a 84 c4 8d a6 a4 dd a5 99 5c |..j............\|
+| 1d e0 c8 04 c8 a5 79 dd b7 17 4d b3 03 03 03 03 |......y...M.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c4 8d a6 a4 dd a5 99 5c 1d e0 c8 04 c8 a5 79 dd |.......\......y.|
+| b7 17 4d b3 |..M. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #459 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 61 dc 13 02 06 28 25 78 a2 09 96 b0 fd 7e a5 db |a....(%x.....~..|
+| 56 35 39 39 f1 dc 19 82 6a c7 ee f3 92 ec 28 a1 |V599....j.....(.|
+| ea 72 87 43 aa 3d 77 a9 82 2d 93 17 0b 24 bd 5b |.r.C.=w..-...$.[|
+Plaintext[48]:
+| 50 8b 94 ae 52 a1 02 67 14 00 00 0c f5 da 03 46 |P...R..g.......F|
+| 0f c1 55 0e 57 3a 4e 1e f6 88 81 97 36 67 06 b5 |..U.W:N.....6g..|
+| 67 59 b8 34 2b 7e 54 45 1a 30 6d 82 03 03 03 03 |gY.4+~TE.0m.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f6 88 81 97 36 67 06 b5 67 59 b8 34 2b 7e 54 45 |....6g..gY.4+~TE|
+| 1a 30 6d 82 |.0m. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #460 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 81 80 6b 8d 20 12 8f 43 83 2a b0 df 83 77 e0 3e |..k. ..C.*...w.>|
+| 19 2b 22 72 ee 8e 2c 62 37 43 77 b7 c4 76 46 f5 |.+"r..,b7Cw..vF.|
+| a1 b5 6f 46 f1 21 2f 62 4e 7b 67 f2 4f 57 2a 53 |..oF.!/bN{g.OW*S|
+| f6 ff 12 45 58 5e 51 39 04 52 94 4c 13 06 a1 b5 |...EX^Q9.R.L....|
+| a7 7d 61 8f 62 5f e3 86 0e 2d e9 af 17 7f 76 74 |.}a.b_...-....vt|
+| 7d 20 e9 9f 6a 84 67 6e 02 9c 88 9b 61 43 c7 6a |} ..j.gn....aC.j|
+| 72 9f 7e d9 f7 98 9f a6 4d dd c4 34 16 7f a7 37 |r.~.....M..4...7|
+Plaintext[112]:
+| 6c 8f 15 ab 9f 0b 1b 29 47 45 54 20 2f 20 48 54 |l......)GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 65 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 |dhe-rsa-des-cbc3|
+| 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 |-sha.local.al.le|
+| 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 39 32 |kensteyn.nl:4492|
+| 0d 0a 0d 0a 51 21 de d4 d5 5c 79 d6 33 30 6a 37 |....Q!...\y.30j7|
+| 42 ad 3d 80 63 12 e7 fa 07 07 07 07 07 07 07 07 |B.=.c...........|
+ssl_decrypt_record found padding 7 final len 104
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 30 d6 bc f4 3b 3e 3a 08 64 4f af bc b6 a8 43 8d |0...;>:.dO....C.|
+| d5 b5 30 93 |..0. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34675 found (nil)
+association_find: TCP port 4492 found 0x3738c90
+
+dissect_ssl enter frame #461 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 8e f3 9c 72 d2 3c 2c b6 77 e9 37 60 c8 97 f7 19 |...r.<,.w.7`....|
+| 27 24 c5 4c 79 0a c3 93 f9 25 ef 34 ff 91 0b 50 |'$.Ly....%.4...P|
+| 4d be c9 e4 bd 1e eb 0e 66 5a de 94 ca 1e 88 9c |M.......fZ......|
+| 74 2a 54 ea 60 40 cd 7d dd 06 63 c9 b1 3b 19 95 |t*T.`@.}..c..;..|
+| ef 70 2c 21 02 25 67 65 7e 4d 06 1f 44 ff ee 82 |.p,!.%ge~M..D...|
+| 45 45 c2 6e a0 a1 62 86 54 0d b6 bb 22 75 ea d6 |EE.n..b.T..."u..|
+| 8f 8e 41 9c 08 ed cf 6a 20 7f 5a ee 87 f8 39 17 |..A....j .Z...9.|
+| fa 42 da f0 b8 58 d0 a6 e4 e9 cb 0e b9 43 30 d0 |.B...X.......C0.|
+| 51 1c 27 28 94 14 5a 0b c0 a2 c9 0e ae e9 e3 85 |Q.'(..Z.........|
+| fa ce f4 dc 19 cd 1a dd ec fd 0a b5 a6 14 4e f1 |..............N.|
+| 11 2b 7a bd 38 55 f9 a9 b4 74 3b cf 41 3a f7 e8 |.+z.8U...t;.A:..|
+| 99 fb 6b 89 f3 30 2f 8a 9c 85 36 7a 44 3b 6b 24 |..k..0/...6zD;k$|
+| af 62 c8 83 36 89 6d ee 21 12 5e ed fb 2e 27 a2 |.b..6.m.!.^...'.|
+| 6e cb a1 e1 30 1d cd 99 bc 0b 05 17 b6 fb 47 07 |n...0.........G.|
+| dd 77 5a a1 fe be fc c9 a2 6e f4 03 c1 02 71 26 |.wZ......n....q&|
+| 23 57 d2 9a 1e 87 3a 07 83 fb 28 1b d8 d5 d4 f9 |#W....:...(.....|
+| 3c ab 09 40 e1 2b 44 36 0d 34 d9 2c 72 04 fc 63 |<..@.+D6.4.,r..c|
+| 00 61 cd 1d 0f a1 e8 78 2a 66 d5 b4 b4 e3 70 bc |.a.....x*f....p.|
+| 2c 2b 29 2c 63 38 60 c7 d3 3f 50 37 70 99 64 fa |,+),c8`..?P7p.d.|
+| 1f ab b3 82 7a a8 6d d1 a7 64 de 5d 2f 8b ec 26 |....z.m..d.]/..&|
+| 20 ee c7 20 92 5c 38 0e 23 e8 c7 51 8e ff c8 32 | .. .\8.#..Q...2|
+| f2 7a 7f 40 65 72 ac c4 92 bd 32 6a 05 a7 64 28 |.z.@er....2j..d(|
+| a4 b2 b7 06 17 1a 5c 5e 54 cb f1 8c 7b 32 2c fc |......\^T...{2,.|
+| f0 b8 72 a2 6c 76 4f 63 84 72 c4 fa 2c 26 bc 82 |..r.lvOc.r..,&..|
+Plaintext[384]:
+| dd cb 0f 81 42 3c fb 9c 48 54 54 50 2f 31 2e 31 |....B<..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 32 30 3a 31 31 3a 33 32 20 47 4d |2013 20:11:32 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 31 32 |che....0xC0,0x12|
+| 20 2d 20 45 43 44 48 45 2d 52 53 41 2d 44 45 53 | - ECDHE-RSA-DES|
+| 2d 43 42 43 33 2d 53 48 41 20 20 53 53 4c 76 33 |-CBC3-SHA SSLv3|
+| 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 3d | Kx=ECDH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 59 40 7e 0b 13 8d db 57 77 1b 45 b5 |ipt>Y@~....Ww.E.|
+| 58 1f fa 12 48 da cb 5e 07 07 07 07 07 07 07 07 |X...H..^........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fc b8 d8 2d 04 e7 ab 9b 62 dd fc 75 d0 f9 3f d3 |...-....b..u..?.|
+| 6f ea da 0b |o... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4492 found 0x3738c90
+
+dissect_ssl enter frame #462 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ab 5f 5c 36 39 90 ad c2 df 7c 3f ae ad 83 2a 61 |._\69....|?...*a|
+| 0d ad a8 0b 31 ba 6f ba 4e 4a 51 98 5b 22 c0 dd |....1.o.NJQ.["..|
+Plaintext[32]:
+| c8 23 01 e5 f8 68 41 ea 01 00 c5 cc 7a 91 0b f8 |.#...hA.....z...|
+| a2 ea a4 8f 3c 70 3f 3b e2 f3 8b 26 b1 d3 01 01 |....<p?;...&....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c5 cc 7a 91 0b f8 a2 ea a4 8f 3c 70 3f 3b e2 f3 |..z.......<p?;..|
+| 8b 26 b1 d3 |.&.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #464 (first time)
+ conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| f8 d5 bf 61 fc ef 6f 7f 47 97 6b 90 ad 29 ba 95 |...a..o.G.k..)..|
+| 26 b1 48 84 bd 4f 91 85 c3 ab a6 bc 93 d2 bc 75 |&.H..O.........u|
+Plaintext[32]:
+| 2b 4f ad 4a 85 63 49 2c 01 00 09 83 f7 21 47 7f |+O.J.cI,.....!G.|
+| e5 c6 7b 9a 7a 6b b4 84 fd 93 af 02 8a 1d 01 01 |..{.zk..........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 09 83 f7 21 47 7f e5 c6 7b 9a 7a 6b b4 84 fd 93 |...!G...{.zk....|
+| af 02 8a 1d |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #469 (first time)
+ssl_session_init: initializing ptr 0x7fca45c0eb80 size 688
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55377 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4493
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #471 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 bf 45 46 07 a5 87 7c 96 9e 98 76 be c3 12 89 |@.EF...|...v....|
+| ea 11 3c 08 73 b4 a1 6c 12 9b 0f 71 7c 56 0a dc |..<.s..l...q|V..|
+| b5 43 a4 0f 46 3e c1 cd 62 3a f9 84 7e d1 50 4e |.C..F>..b:..~.PN|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 b7 18 c2 08 21 9b 56 be 7a a2 74 e3 f1 f0 bb |.....!.V.z.t....|
+| 1d ff 87 bd 24 a2 e1 66 de 81 ff b6 0c 52 34 c2 |....$..f.....R4.|
+| f4 38 0a 55 6e 40 19 98 a3 ec 46 b9 91 e2 1d 18 |.8.Un@....F.....|
+| 84 7c b4 f8 fa 2a 08 0a 0a 12 02 53 72 |.|...*.....Sr |
+hash out[104]:
+| 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.|
+| c4 bf f6 ec 17 44 3a e6 31 52 65 0d ff fb 1c cf |.....D:.1Re.....|
+| f7 93 37 78 7e c8 8e 9c 99 65 68 13 73 94 5e d0 |..7x~....eh.s.^.|
+| 03 55 9d 00 fd bd 10 73 fc 1a b0 44 7b 00 51 e2 |.U.....s...D{.Q.|
+| 86 9f 75 5c a3 1d 33 50 bc a4 03 2e 6f 0d 24 78 |..u\..3P....o.$x|
+| 39 09 fc a7 76 aa 4d c2 f3 cb 69 2b f8 e7 df 26 |9...v.M...i+...&|
+| 2f aa 13 24 4d 89 c0 d1 |/..$M... |
+PRF out[104]:
+| 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.|
+| c4 bf f6 ec 17 44 3a e6 31 52 65 0d ff fb 1c cf |.....D:.1Re.....|
+| f7 93 37 78 7e c8 8e 9c 99 65 68 13 73 94 5e d0 |..7x~....eh.s.^.|
+| 03 55 9d 00 fd bd 10 73 fc 1a b0 44 7b 00 51 e2 |.U.....s...D{.Q.|
+| 86 9f 75 5c a3 1d 33 50 bc a4 03 2e 6f 0d 24 78 |..u\..3P....o.$x|
+| 39 09 fc a7 76 aa 4d c2 f3 cb 69 2b f8 e7 df 26 |9...v.M...i+...&|
+| 2f aa 13 24 4d 89 c0 d1 |/..$M... |
+key expansion[104]:
+| 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.|
+| c4 bf f6 ec 17 44 3a e6 31 52 65 0d ff fb 1c cf |.....D:.1Re.....|
+| f7 93 37 78 7e c8 8e 9c 99 65 68 13 73 94 5e d0 |..7x~....eh.s.^.|
+| 03 55 9d 00 fd bd 10 73 fc 1a b0 44 7b 00 51 e2 |.U.....s...D{.Q.|
+| 86 9f 75 5c a3 1d 33 50 bc a4 03 2e 6f 0d 24 78 |..u\..3P....o.$x|
+| 39 09 fc a7 76 aa 4d c2 f3 cb 69 2b f8 e7 df 26 |9...v.M...i+...&|
+| 2f aa 13 24 4d 89 c0 d1 |/..$M... |
+Client MAC key[20]:
+| 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.|
+| c4 bf f6 ec |.... |
+Server MAC key[20]:
+| 17 44 3a e6 31 52 65 0d ff fb 1c cf f7 93 37 78 |.D:.1Re.......7x|
+| 7e c8 8e 9c |~... |
+Client Write key[16]:
+| 99 65 68 13 73 94 5e d0 03 55 9d 00 fd bd 10 73 |.eh.s.^..U.....s|
+Server Write key[16]:
+| fc 1a b0 44 7b 00 51 e2 86 9f 75 5c a3 1d 33 50 |...D{.Q...u\..3P|
+Client Write IV[16]:
+| bc a4 03 2e 6f 0d 24 78 39 09 fc a7 76 aa 4d c2 |....o.$x9...v.M.|
+Server Write IV[16]:
+| f3 cb 69 2b f8 e7 df 26 2f aa 13 24 4d 89 c0 d1 |..i+...&/..$M...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #473 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa...
+looking for RSA pre-master41042cc3fd46a683672b719b04ca25c6a7e4450038267669...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f4ce9233b89dd4aa176a84fb68668eafad9e37a80a0ae9c289197e5f78 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa2a080a0a12025372 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 17 56 88 57 b1 97 e1 28 1f fc 30 ad 3a 5b 59 47 |.V.W...(..0.:[YG|
+| 9f ef cd 3c 04 28 83 0e 79 74 14 f8 5b 63 cf 2a |...<.(..yt..[c.*|
+| 3d 16 f6 fd fa 63 98 11 4e 9f 36 45 3c 90 2f 03 |=....c..N.6E<./.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 b7 18 c2 08 21 9b 56 be 7a a2 74 e3 f1 f0 bb |.....!.V.z.t....|
+| 1d ff 87 bd 24 a2 e1 66 de 81 ff b6 0c 52 34 c2 |....$..f.....R4.|
+| f4 38 0a 55 6e 40 19 98 a3 ec 46 b9 91 e2 1d 18 |.8.Un@....F.....|
+| 84 7c b4 f8 fa 2a 08 0a 0a 12 02 53 72 |.|...*.....Sr |
+hash out[104]:
+| 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v|
+| e9 47 72 69 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 |.Gri).H.x1..=...|
+| 70 94 1a 76 8e 84 06 ad 8a 02 c7 b7 bf 53 16 c6 |p..v.........S..|
+| b0 be 72 a0 ae 77 84 22 fc 22 78 75 81 e5 45 b8 |..r..w."."xu..E.|
+| e9 32 10 d7 fc 51 3b 64 74 88 4b 93 52 b2 5f 89 |.2...Q;dt.K.R._.|
+| 30 5c 96 a7 f7 b5 d4 bd ac 02 14 80 71 31 40 e3 |0\..........q1@.|
+| 75 f6 4d c3 82 8c 66 08 |u.M...f. |
+PRF out[104]:
+| 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v|
+| e9 47 72 69 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 |.Gri).H.x1..=...|
+| 70 94 1a 76 8e 84 06 ad 8a 02 c7 b7 bf 53 16 c6 |p..v.........S..|
+| b0 be 72 a0 ae 77 84 22 fc 22 78 75 81 e5 45 b8 |..r..w."."xu..E.|
+| e9 32 10 d7 fc 51 3b 64 74 88 4b 93 52 b2 5f 89 |.2...Q;dt.K.R._.|
+| 30 5c 96 a7 f7 b5 d4 bd ac 02 14 80 71 31 40 e3 |0\..........q1@.|
+| 75 f6 4d c3 82 8c 66 08 |u.M...f. |
+key expansion[104]:
+| 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v|
+| e9 47 72 69 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 |.Gri).H.x1..=...|
+| 70 94 1a 76 8e 84 06 ad 8a 02 c7 b7 bf 53 16 c6 |p..v.........S..|
+| b0 be 72 a0 ae 77 84 22 fc 22 78 75 81 e5 45 b8 |..r..w."."xu..E.|
+| e9 32 10 d7 fc 51 3b 64 74 88 4b 93 52 b2 5f 89 |.2...Q;dt.K.R._.|
+| 30 5c 96 a7 f7 b5 d4 bd ac 02 14 80 71 31 40 e3 |0\..........q1@.|
+| 75 f6 4d c3 82 8c 66 08 |u.M...f. |
+Client MAC key[20]:
+| 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v|
+| e9 47 72 69 |.Gri |
+Server MAC key[20]:
+| 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 70 94 1a 76 |).H.x1..=...p..v|
+| 8e 84 06 ad |.... |
+Client Write key[16]:
+| 8a 02 c7 b7 bf 53 16 c6 b0 be 72 a0 ae 77 84 22 |.....S....r..w."|
+Server Write key[16]:
+| fc 22 78 75 81 e5 45 b8 e9 32 10 d7 fc 51 3b 64 |."xu..E..2...Q;d|
+Client Write IV[16]:
+| 74 88 4b 93 52 b2 5f 89 30 5c 96 a7 f7 b5 d4 bd |t.K.R._.0\......|
+Server Write IV[16]:
+| ac 02 14 80 71 31 40 e3 75 f6 4d c3 82 8c 66 08 |....q1@.u.M...f.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 17 56 88 57 b1 97 e1 28 1f fc 30 ad 3a 5b 59 47 |.V.W...(..0.:[YG|
+| 9f ef cd 3c 04 28 83 0e 79 74 14 f8 5b 63 cf 2a |...<.(..yt..[c.*|
+| 3d 16 f6 fd fa 63 98 11 4e 9f 36 45 3c 90 2f 03 |=....c..N.6E<./.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 4d b4 38 95 85 e9 d7 83 90 60 06 39 69 59 eb 79 |M.8......`.9iY.y|
+| 31 c8 69 76 31 08 03 41 02 e4 2f f9 1f d5 12 b9 |1.iv1..A../.....|
+| 40 bc 41 7f 40 ea 11 e4 a7 18 53 6f 83 c3 16 5b |@.A.@.....So...[|
+| 8b 76 90 aa 75 f1 58 c0 f8 c5 82 97 1f 26 bd 51 |.v..u.X......&.Q|
+Plaintext[64]:
+| ab a9 33 70 90 9f 86 bd d7 1f fe da 3e 1d 9b e6 |..3p........>...|
+| 14 00 00 0c 10 6a 98 cb 6c 2c 7b c1 21 35 1d df |.....j..l,{.!5..|
+| 3b 90 19 ab 6b 00 d4 02 c3 1d d1 03 b4 08 7a c2 |;...k.........z.|
+| 48 64 dd 00 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |Hd..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3b 90 19 ab 6b 00 d4 02 c3 1d d1 03 b4 08 7a c2 |;...k.........z.|
+| 48 64 dd 00 |Hd.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #474 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a1 7a c0 10 9a 06 b5 5a cd ea 12 63 d5 5a 21 cf |.z.....Z...c.Z!.|
+| 91 6b 18 c1 16 92 75 92 1a 3e 08 8d 34 ff ae 8b |.k....u..>..4...|
+| 81 d9 f1 3e 18 77 48 81 9c 34 b5 32 70 95 42 3b |...>.wH..4.2p.B;|
+| a7 43 08 4c 31 6c 8a 98 8a 89 70 07 4c 9c a7 86 |.C.L1l....p.L...|
+Plaintext[64]:
+| e8 73 8b dc 98 14 bb 1e ad 32 4d bf 59 17 09 f1 |.s.......2M.Y...|
+| 14 00 00 0c 4e cf 9d 2d b1 7f c5 ac d4 92 b2 02 |....N..-........|
+| 42 31 dd 10 5d 97 48 4a ae ef 21 dc b4 68 eb 76 |B1..].HJ..!..h.v|
+| eb 80 af f0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 42 31 dd 10 5d 97 48 4a ae ef 21 dc b4 68 eb 76 |B1..].HJ..!..h.v|
+| eb 80 af f0 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #475 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 2b 01 7a 0a 26 9f d5 a4 00 ce 7e 32 4d bb 0c d7 |+.z.&.....~2M...|
+| 25 e6 b7 c3 7b b8 fe 3b 83 f3 75 39 7d 89 31 7c |%...{..;..u9}.1||
+| 0e 80 4f aa 64 3c f7 ef 95 d6 30 ac e7 32 2e 12 |..O.d<....0..2..|
+| 15 74 62 dd 8b aa 73 4a 20 64 11 ac 37 f8 35 41 |.tb...sJ d..7.5A|
+| 61 2b 13 7f 4e 87 8e 8b ef 85 56 3b 55 85 a5 cd |a+..N.....V;U...|
+| d9 f6 56 c4 49 f8 dd 9e e6 78 9a ae cb bf 70 59 |..V.I....x....pY|
+| 73 2b 2c a9 94 6f 1a 41 2e f2 5c 43 29 d2 47 38 |s+,..o.A..\C).G8|
+Plaintext[112]:
+| 6d c3 c5 f6 1f 80 34 7f c6 59 6a 0e e4 42 56 45 |m.....4..Yj..BVE|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 33 0d 0a 0d 0a 50 de 49 60 37 95 |l:4493....P.I`7.|
+| cf 0b 4c 2c e1 48 55 77 be 63 fe e5 67 ee 01 01 |..L,.HUw.c..g...|
+ssl_decrypt_record found padding 1 final len 110
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 34 ab ba 62 2c 60 ca 30 82 c8 d9 47 30 55 12 b5 |4..b,`.0...G0U..|
+| 1d 53 4e 7c |.SN| |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55377 found (nil)
+association_find: TCP port 4493 found 0x3738d20
+
+dissect_ssl enter frame #476 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 6d 25 95 2b 09 2b 7d f1 61 4f 8c 28 f9 d7 57 3a |m%.+.+}.aO.(..W:|
+| 29 42 1c 58 57 a7 62 1a d2 c0 f0 b1 e0 64 fb 23 |)B.XW.b......d.#|
+| 48 0d 7d af b6 05 1b 1e 6a 57 8d 9a 01 ea a7 92 |H.}.....jW......|
+| c1 8b 5e 73 71 23 5a 81 31 a2 76 42 a7 68 5b c5 |..^sq#Z.1.vB.h[.|
+| db 7e 02 e0 f5 09 cf 65 9d 13 2f 49 dc 1b c8 49 |.~.....e../I...I|
+| 05 88 60 77 4c db 4a e4 9d ff 8e 52 7c 9c 7f 4d |..`wL.J....R|..M|
+| 35 a2 c7 f7 d8 bc f8 3e 31 ec 5c 81 05 11 12 b3 |5......>1.\.....|
+| 7f 32 60 ca e9 c7 a9 f3 73 b1 52 7b 79 e1 b4 3c |.2`.....s.R{y..<|
+| 77 91 35 70 af 3c fa 42 07 b5 f5 53 b7 fa f3 f9 |w.5p.<.B...S....|
+| 02 dd 33 1f 89 98 2c c0 91 91 75 d1 a1 83 0d 69 |..3...,...u....i|
+| 94 3b 9a 80 d3 81 29 f9 a3 b1 ec d8 92 fa 67 fd |.;....).......g.|
+| 2f 8f fa 32 1b 55 84 8d 14 f3 a9 a1 3c e0 4b f3 |/..2.U......<.K.|
+| 66 8a fe 28 79 b0 d0 0b 5e 4a 05 22 8a 3a da 05 |f..(y...^J.".:..|
+| 29 80 2c 16 c2 1f 2b 85 6f cc 8d db 22 4f d6 0a |).,...+.o..."O..|
+| 17 54 41 45 a5 90 4a de 19 69 7c 34 20 c9 b6 c3 |.TAE..J..i|4 ...|
+| ce 41 3f b5 73 8b b3 85 ae 22 3a 00 47 b8 08 ad |.A?.s....":.G...|
+| 83 b8 cb dc 96 07 9f 9c 44 7d ea 4f ee ac eb 3a |........D}.O...:|
+| 8d 15 21 ab 2d 47 a1 b5 ba 31 0f b9 49 b4 1a 2b |..!.-G...1..I..+|
+| fd b5 ea cc 8a a8 e0 48 fd aa 25 d3 b4 16 bc ca |.......H..%.....|
+| 30 a4 61 d2 5b 00 d9 75 e5 19 94 b4 fa 10 e2 f3 |0.a.[..u........|
+| e8 61 0d 49 f7 07 fb 21 e0 13 17 61 6a 78 01 e0 |.a.I...!...ajx..|
+| 62 19 11 84 23 41 c9 38 c6 5b 3a a5 31 f1 ba 81 |b...#A.8.[:.1...|
+| 94 10 7f a5 c9 5e 86 bd 09 2d a9 f5 86 57 5b 59 |.....^...-...W[Y|
+| aa aa 55 83 7a b7 9c 9e 4f ab 7c d1 12 29 55 5a |..U.z...O.|..)UZ|
+| 65 76 89 b8 61 b5 02 2f aa 4f 00 b4 f1 9d e9 74 |ev..a../.O.....t|
+Plaintext[400]:
+| c8 90 db 49 f5 a9 c5 a5 30 4b e7 d7 35 db 05 1c |...I....0K..5...|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:32 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 92 f7 7b 9b |nl'</script>..{.|
+| af 86 e8 17 32 fa c7 22 6d 75 1d 7c 60 d5 de af |....2.."mu.|`...|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8a f8 05 f0 61 80 c1 a3 29 04 5c 86 39 8e ea cd |....a...).\.9...|
+| c2 b3 e2 77 |...w |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4493 found 0x3738d20
+
+dissect_ssl enter frame #477 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 84 22 01 72 bc bc 6c f8 96 91 0f 7e f4 f0 f6 29 |.".r..l....~...)|
+| 8b fc 82 2e fe 04 df b7 4c 76 51 20 4b 05 3a a2 |........LvQ K.:.|
+| 7c 4e 62 41 04 4d c7 e1 81 e8 c8 3c 0f e1 f2 89 ||NbA.M.....<....|
+Plaintext[48]:
+| f1 38 b9 fe ab 65 ae 56 57 2f de 7b 84 85 b1 7b |.8...e.VW/.{...{|
+| 01 00 b8 0f 1b 19 c8 e1 1b 19 98 a7 55 fb d5 b6 |............U...|
+| d0 88 96 3a 88 47 09 09 09 09 09 09 09 09 09 09 |...:.G..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b8 0f 1b 19 c8 e1 1b 19 98 a7 55 fb d5 b6 d0 88 |..........U.....|
+| 96 3a 88 47 |.:.G |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #479 (first time)
+ conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 0e f5 39 20 06 66 12 8a e9 c7 b3 14 71 a2 ca ea |..9 .f......q...|
+| 46 31 bc bb 4b ac b1 ba f8 35 45 a4 75 f8 6f 05 |F1..K....5E.u.o.|
+| a4 2f 15 af 60 a4 1c 3e 86 95 a4 b9 42 e3 c0 ff |./..`..>....B...|
+Plaintext[48]:
+| ab 02 89 87 9d f8 7f 8d f3 16 1b f8 0b db 12 84 |................|
+| 01 00 79 3e 80 47 7b 39 b5 1e 55 3b 71 ed 4f 98 |..y>.G{9..U;q.O.|
+| 08 0c df bd 4a 25 09 09 09 09 09 09 09 09 09 09 |....J%..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 3e 80 47 7b 39 b5 1e 55 3b 71 ed 4f 98 08 0c |y>.G{9..U;q.O...|
+| df bd 4a 25 |..J% |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #484 (first time)
+ssl_session_init: initializing ptr 0x7fca45c11040 size 688
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 41596 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4494
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #486 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 17 56 88 57 b1 97 e1 28 1f fc 30 ad 3a 5b 59 47 |.V.W...(..0.:[YG|
+| 9f ef cd 3c 04 28 83 0e 79 74 14 f8 5b 63 cf 2a |...<.(..yt..[c.*|
+| 3d 16 f6 fd fa 63 98 11 4e 9f 36 45 3c 90 2f 03 |=....c..N.6E<./.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 85 33 55 63 5c b2 ab 38 2e c6 41 0b 62 06 03 |..3Uc\..8..A.b..|
+| 52 6b 93 a1 19 2f 96 0a 1b cc 40 3e 50 52 34 c2 |Rk.../....@>PR4.|
+| f4 0a 09 b6 fc f7 21 c3 05 06 c8 d6 4b 44 9b 2c |......!.....KD.,|
+| d4 73 80 05 8c 5c 91 69 89 92 37 fe a3 |.s...\.i..7.. |
+hash out[136]:
+| b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..|
+| 2e 87 a1 fb 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 |....K.V...&.[...|
+| a2 f0 1f 81 69 89 90 2e 16 e4 cf ec 11 bb 76 94 |....i.........v.|
+| 13 6f 60 5f 68 00 0b e7 d0 76 96 4b a9 51 ea 65 |.o`_h....v.K.Q.e|
+| 9b 02 1a ee 7a 6e d9 27 d0 e1 17 90 04 4b db 60 |....zn.'.....K.`|
+| 32 7a dd 7d f8 93 96 14 e2 17 f2 16 37 52 cb c9 |2z.}........7R..|
+| 49 0f 72 d5 88 eb 55 35 11 b2 33 7c 90 8c e7 ec |I.r...U5..3|....|
+| 31 f1 aa 69 2d 70 4a 90 91 d2 c0 7a 70 ae 8e 54 |1..i-pJ....zp..T|
+| 44 ae 84 93 ab 78 da a9 |D....x.. |
+PRF out[136]:
+| b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..|
+| 2e 87 a1 fb 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 |....K.V...&.[...|
+| a2 f0 1f 81 69 89 90 2e 16 e4 cf ec 11 bb 76 94 |....i.........v.|
+| 13 6f 60 5f 68 00 0b e7 d0 76 96 4b a9 51 ea 65 |.o`_h....v.K.Q.e|
+| 9b 02 1a ee 7a 6e d9 27 d0 e1 17 90 04 4b db 60 |....zn.'.....K.`|
+| 32 7a dd 7d f8 93 96 14 e2 17 f2 16 37 52 cb c9 |2z.}........7R..|
+| 49 0f 72 d5 88 eb 55 35 11 b2 33 7c 90 8c e7 ec |I.r...U5..3|....|
+| 31 f1 aa 69 2d 70 4a 90 91 d2 c0 7a 70 ae 8e 54 |1..i-pJ....zp..T|
+| 44 ae 84 93 ab 78 da a9 |D....x.. |
+key expansion[136]:
+| b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..|
+| 2e 87 a1 fb 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 |....K.V...&.[...|
+| a2 f0 1f 81 69 89 90 2e 16 e4 cf ec 11 bb 76 94 |....i.........v.|
+| 13 6f 60 5f 68 00 0b e7 d0 76 96 4b a9 51 ea 65 |.o`_h....v.K.Q.e|
+| 9b 02 1a ee 7a 6e d9 27 d0 e1 17 90 04 4b db 60 |....zn.'.....K.`|
+| 32 7a dd 7d f8 93 96 14 e2 17 f2 16 37 52 cb c9 |2z.}........7R..|
+| 49 0f 72 d5 88 eb 55 35 11 b2 33 7c 90 8c e7 ec |I.r...U5..3|....|
+| 31 f1 aa 69 2d 70 4a 90 91 d2 c0 7a 70 ae 8e 54 |1..i-pJ....zp..T|
+| 44 ae 84 93 ab 78 da a9 |D....x.. |
+Client MAC key[20]:
+| b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..|
+| 2e 87 a1 fb |.... |
+Server MAC key[20]:
+| 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 a2 f0 1f 81 |K.V...&.[.......|
+| 69 89 90 2e |i... |
+Client Write key[32]:
+| 16 e4 cf ec 11 bb 76 94 13 6f 60 5f 68 00 0b e7 |......v..o`_h...|
+| d0 76 96 4b a9 51 ea 65 9b 02 1a ee 7a 6e d9 27 |.v.K.Q.e....zn.'|
+Server Write key[32]:
+| d0 e1 17 90 04 4b db 60 32 7a dd 7d f8 93 96 14 |.....K.`2z.}....|
+| e2 17 f2 16 37 52 cb c9 49 0f 72 d5 88 eb 55 35 |....7R..I.r...U5|
+Client Write IV[16]:
+| 11 b2 33 7c 90 8c e7 ec 31 f1 aa 69 2d 70 4a 90 |..3|....1..i-pJ.|
+Server Write IV[16]:
+| 91 d2 c0 7a 70 ae 8e 54 44 ae 84 93 ab 78 da a9 |...zp..TD....x..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #488 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt
+looking for CLIENT_RANDOM 5234c2f40a09b6fcf721c30506c8d64b449b2cd47380058c...
+looking for RSA pre-master4104c327482617ac5e1fb9b9695fa90f517d621bf6156578...
+ checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f4ce9233b89dd4aa176a84fb68668eafad9e37a80a0ae9c289197e5f78 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa2a080a0a12025372 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f4b718c208219b56be7aa274e3f1f0bb1dff87bd24a2e166de81ffb60c 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f4853355635cb2ab382ec6410b620603526b93a1192f960a1bcc403e50 D6DCD0ADA9C6F7D26DDACC44ADDF480E1524A7644FE45A4A0901DD107E02C63038147C8EE151C75832839B1677083D19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c2f40a09b6fcf721c30506c8d64b449b2cd47380058c5c9169899237fea3 D6DCD0ADA9C6F7D26DDACC44ADDF480E1524A7644FE45A4A0901DD107E02C63038147C8EE151C75832839B1677083D19
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d6 dc d0 ad a9 c6 f7 d2 6d da cc 44 ad df 48 0e |........m..D..H.|
+| 15 24 a7 64 4f e4 5a 4a 09 01 dd 10 7e 02 c6 30 |.$.dO.ZJ....~..0|
+| 38 14 7c 8e e1 51 c7 58 32 83 9b 16 77 08 3d 19 |8.|..Q.X2...w.=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.|
+| f4 85 33 55 63 5c b2 ab 38 2e c6 41 0b 62 06 03 |..3Uc\..8..A.b..|
+| 52 6b 93 a1 19 2f 96 0a 1b cc 40 3e 50 52 34 c2 |Rk.../....@>PR4.|
+| f4 0a 09 b6 fc f7 21 c3 05 06 c8 d6 4b 44 9b 2c |......!.....KD.,|
+| d4 73 80 05 8c 5c 91 69 89 92 37 fe a3 |.s...\.i..7.. |
+hash out[136]:
+| 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.|
+| 02 06 e2 6d cc 36 26 4b 38 bf fb cb 73 d6 a8 1c |...m.6&K8...s...|
+| 92 86 38 33 78 73 56 f0 01 19 d8 c6 62 33 e6 b5 |..83xsV.....b3..|
+| 1e 76 f1 86 99 90 68 3c f6 c0 f2 d7 c7 5c b0 08 |.v....h<.....\..|
+| 50 cb f1 af ce 35 9a 26 14 02 8f 53 a5 6a 5a d6 |P....5.&...S.jZ.|
+| 06 58 1f f2 5a c4 3a 99 cf 90 43 22 67 c7 aa ed |.X..Z.:...C"g...|
+| e3 0b 6c e1 2b 45 18 b4 a5 3a 62 b7 d8 26 b9 88 |..l.+E...:b..&..|
+| f6 20 d7 5d e3 fc 44 37 2f c5 95 a7 30 88 2e ae |. .]..D7/...0...|
+| d4 6e 3a 60 2a f1 0c c2 |.n:`*... |
+PRF out[136]:
+| 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.|
+| 02 06 e2 6d cc 36 26 4b 38 bf fb cb 73 d6 a8 1c |...m.6&K8...s...|
+| 92 86 38 33 78 73 56 f0 01 19 d8 c6 62 33 e6 b5 |..83xsV.....b3..|
+| 1e 76 f1 86 99 90 68 3c f6 c0 f2 d7 c7 5c b0 08 |.v....h<.....\..|
+| 50 cb f1 af ce 35 9a 26 14 02 8f 53 a5 6a 5a d6 |P....5.&...S.jZ.|
+| 06 58 1f f2 5a c4 3a 99 cf 90 43 22 67 c7 aa ed |.X..Z.:...C"g...|
+| e3 0b 6c e1 2b 45 18 b4 a5 3a 62 b7 d8 26 b9 88 |..l.+E...:b..&..|
+| f6 20 d7 5d e3 fc 44 37 2f c5 95 a7 30 88 2e ae |. .]..D7/...0...|
+| d4 6e 3a 60 2a f1 0c c2 |.n:`*... |
+key expansion[136]:
+| 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.|
+| 02 06 e2 6d cc 36 26 4b 38 bf fb cb 73 d6 a8 1c |...m.6&K8...s...|
+| 92 86 38 33 78 73 56 f0 01 19 d8 c6 62 33 e6 b5 |..83xsV.....b3..|
+| 1e 76 f1 86 99 90 68 3c f6 c0 f2 d7 c7 5c b0 08 |.v....h<.....\..|
+| 50 cb f1 af ce 35 9a 26 14 02 8f 53 a5 6a 5a d6 |P....5.&...S.jZ.|
+| 06 58 1f f2 5a c4 3a 99 cf 90 43 22 67 c7 aa ed |.X..Z.:...C"g...|
+| e3 0b 6c e1 2b 45 18 b4 a5 3a 62 b7 d8 26 b9 88 |..l.+E...:b..&..|
+| f6 20 d7 5d e3 fc 44 37 2f c5 95 a7 30 88 2e ae |. .]..D7/...0...|
+| d4 6e 3a 60 2a f1 0c c2 |.n:`*... |
+Client MAC key[20]:
+| 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.|
+| 02 06 e2 6d |...m |
+Server MAC key[20]:
+| cc 36 26 4b 38 bf fb cb 73 d6 a8 1c 92 86 38 33 |.6&K8...s.....83|
+| 78 73 56 f0 |xsV. |
+Client Write key[32]:
+| 01 19 d8 c6 62 33 e6 b5 1e 76 f1 86 99 90 68 3c |....b3...v....h<|
+| f6 c0 f2 d7 c7 5c b0 08 50 cb f1 af ce 35 9a 26 |.....\..P....5.&|
+Server Write key[32]:
+| 14 02 8f 53 a5 6a 5a d6 06 58 1f f2 5a c4 3a 99 |...S.jZ..X..Z.:.|
+| cf 90 43 22 67 c7 aa ed e3 0b 6c e1 2b 45 18 b4 |..C"g.....l.+E..|
+Client Write IV[16]:
+| a5 3a 62 b7 d8 26 b9 88 f6 20 d7 5d e3 fc 44 37 |.:b..&... .]..D7|
+Server Write IV[16]:
+| 2f c5 95 a7 30 88 2e ae d4 6e 3a 60 2a f1 0c c2 |/...0....n:`*...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| d6 dc d0 ad a9 c6 f7 d2 6d da cc 44 ad df 48 0e |........m..D..H.|
+| 15 24 a7 64 4f e4 5a 4a 09 01 dd 10 7e 02 c6 30 |.$.dO.ZJ....~..0|
+| 38 14 7c 8e e1 51 c7 58 32 83 9b 16 77 08 3d 19 |8.|..Q.X2...w.=.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 37 f7 7f ec 82 70 b0 39 24 dd 14 e1 a5 6f 6c 5f |7....p.9$....ol_|
+| a9 3b 50 a8 1a 4e 1d a7 12 e5 87 ea 0e ea 4c 77 |.;P..N........Lw|
+| 8c 38 94 5d ef 76 b7 2b 16 bf 86 f9 b2 ce a9 9d |.8.].v.+........|
+| 59 30 2a d9 27 e9 44 60 c2 b6 e0 b2 ec 77 89 0d |Y0*.'.D`.....w..|
+Plaintext[64]:
+| 41 87 90 f4 3a ee 1c d7 3c b1 b5 ab 64 cd 2f f2 |A...:...<...d./.|
+| 14 00 00 0c a8 80 ce 35 a2 47 5c e5 28 18 52 4c |.......5.G\.(.RL|
+| 8b aa da 03 ec a3 c4 97 bc 95 39 9f af 20 4d 8e |..........9.. M.|
+| 7b 34 ae a1 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |{4..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8b aa da 03 ec a3 c4 97 bc 95 39 9f af 20 4d 8e |..........9.. M.|
+| 7b 34 ae a1 |{4.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #489 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 52 84 7b 64 9d 92 a9 d0 e8 d7 90 a9 3d 04 00 86 |R.{d........=...|
+| 17 ff b9 16 d8 62 f7 67 89 76 2f 65 b4 2c c5 06 |.....b.g.v/e.,..|
+| 6d 0f 14 5e 90 ee 3d bd 03 26 d8 3d d8 fc d6 1b |m..^..=..&.=....|
+| 52 1e 85 2c 0d b5 b4 8c b7 ed d6 14 13 f8 09 ae |R..,............|
+Plaintext[64]:
+| 86 64 11 0b e4 93 04 37 b1 b8 04 c9 2a 71 85 0a |.d.....7....*q..|
+| 14 00 00 0c 6e 74 5f 4f 97 5e 0f c6 97 3d 59 6e |....nt_O.^...=Yn|
+| 7f a4 ac 84 3a b5 ff 85 9b 74 c2 22 d2 ba 89 15 |....:....t."....|
+| 7f a5 fa 8b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7f a4 ac 84 3a b5 ff 85 9b 74 c2 22 d2 ba 89 15 |....:....t."....|
+| 7f a5 fa 8b |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #490 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 1b 54 2e 94 7c 3a 39 c5 cc 08 71 bd 10 5c c5 65 |.T..|:9...q..\.e|
+| e7 07 9a bb 78 41 75 22 5b fb 0b 9c 78 34 c5 38 |....xAu"[...x4.8|
+| 3e 98 26 45 5e a7 84 77 68 d9 59 e9 d8 88 9c 0f |>.&E^..wh.Y.....|
+| 29 81 eb 1b e6 41 d9 c4 73 c2 ea 54 47 a3 42 a2 |)....A..s..TG.B.|
+| a6 eb 7a 06 14 3f 20 4d 8f 5c 84 d4 c3 d2 ec bd |..z..? M.\......|
+| 8b 1d 1d 54 18 08 92 b7 94 5f 4a b8 0e 65 ec ba |...T....._J..e..|
+| e6 88 3a 1b bd 7d 21 6b f5 d6 3b 95 44 99 22 36 |..:..}!k..;.D."6|
+Plaintext[112]:
+| 3a 38 d8 12 09 3b cb fe 52 e7 8e 90 54 01 dd 7f |:8...;..R...T...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 34 0d 0a 0d 0a dd 4b ac 02 a8 9c |l:4494.....K....|
+| 34 4d 11 7a 66 8c ec 52 7f cc 83 9b 71 ec 01 01 |4M.zf..R....q...|
+ssl_decrypt_record found padding 1 final len 110
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ea b7 0c e5 66 5f 07 21 6b 6f 9a ba a8 73 e4 f6 |....f_.!ko...s..|
+| c2 ba 2f c2 |../. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 41596 found (nil)
+association_find: TCP port 4494 found 0x3738db0
+
+dissect_ssl enter frame #491 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d3 e2 2c 4f 4e f8 55 fd 7d c2 80 69 d5 d8 0a 5e |..,ON.U.}..i...^|
+| 2d a6 71 3c b7 f2 2a 18 d1 c0 f6 1d 5f 8f 53 75 |-.q<..*....._.Su|
+| 5b ce 17 1b 8b b5 38 93 90 37 57 ed fd 0d 08 50 |[.....8..7W....P|
+| f3 78 55 93 df 71 7c 99 26 14 41 34 81 5e 0b 89 |.xU..q|.&.A4.^..|
+| 4c 86 da 21 db 45 93 f5 46 66 65 12 66 42 f7 bc |L..!.E..Ffe.fB..|
+| 28 01 5b aa ce 53 30 6a 18 08 f1 b1 1f 1b 14 03 |(.[..S0j........|
+| c9 81 cc 68 ec 44 27 00 72 0f 22 b4 38 b0 07 bb |...h.D'.r.".8...|
+| 67 9c 79 89 aa 52 b7 2a 9c 66 a4 08 41 d1 0d 48 |g.y..R.*.f..A..H|
+| 96 c6 1b f2 23 0d 6a 2c 23 e0 ab 36 4c 9f 8b 61 |....#.j,#..6L..a|
+| 6f 6e df f1 c6 6f 0f bc 65 a0 8c e0 3c 43 7e 30 |on...o..e...<C~0|
+| be fc 46 f1 ca d1 fc 2c f4 92 57 1f cb 36 73 ad |..F....,..W..6s.|
+| e5 fa 73 04 70 0d ac 5f 6e 99 d0 5a 1f a2 39 cf |..s.p.._n..Z..9.|
+| 9c f6 d0 84 66 f0 ef 96 dd 40 64 f1 3a d0 b1 b9 |....f....@d.:...|
+| d9 89 64 6c 1e bc 5a 95 b6 f5 dc 79 1c c4 04 58 |..dl..Z....y...X|
+| 39 b9 b7 1a 93 0d 13 d5 4d 2a 65 78 09 3c 5f 91 |9.......M*ex.<_.|
+| 81 3a 7b 1b 9f 66 4c ff cd 88 6f 2a 09 99 b3 93 |.:{..fL...o*....|
+| 0e 8d 61 fd ee 0a fb a5 1a 6e 21 ba ce 32 e5 4b |..a......n!..2.K|
+| 65 21 b2 a0 71 6b c5 c9 85 13 c0 d9 09 36 0f c8 |e!..qk.......6..|
+| af b8 08 4c 5d cd f9 7e bd d9 40 e2 8c 8b ab ed |...L]..~..@.....|
+| 2c 9f 4c 3b f3 e1 59 4f 86 95 46 ea 8e 7b c0 59 |,.L;..YO..F..{.Y|
+| e6 8e d9 83 84 ab 8c cf 00 e5 47 1c e6 82 a1 5c |..........G....\|
+| 8d 5a 58 47 6a 09 bc eb bf 81 bf cd 35 b4 a9 c1 |.ZXGj.......5...|
+| 9e 89 10 36 ee c5 b3 d6 3b 02 10 65 84 34 54 5a |...6....;..e.4TZ|
+| 0c 17 3f fe 7b 85 32 50 dc e0 2c c6 df ef 45 0f |..?.{.2P..,...E.|
+| b2 32 a7 be 1d 96 66 cd 1d 01 1c 51 72 cb f9 9f |.2....f....Qr...|
+Plaintext[400]:
+| 00 7a 5b 08 63 2d 73 b1 65 cd 12 b2 85 58 56 db |.z[.c-s.e....XV.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 31 31 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:32 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 08 0f 40 24 |nl'</script>..@$|
+| ba 9d c0 48 55 92 79 7d 72 93 bc de 1f 5c 3d 1c |...HU.y}r....\=.|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2f 85 f4 de 37 41 84 cc b2 0c 78 a6 42 94 84 4e |/...7A....x.B..N|
+| 2a 12 9e 61 |*..a |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4494 found 0x3738db0
+
+dissect_ssl enter frame #492 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f2 92 b7 6b a3 30 e6 86 97 6d 2b 20 99 4a 2a 9b |...k.0...m+ .J*.|
+| 16 7a 92 97 fb a5 95 27 eb 1f 31 5c d7 34 00 ef |.z.....'..1\.4..|
+| 7a 63 f0 a4 ee e3 c6 00 96 47 75 8d 14 77 33 55 |zc.......Gu..w3U|
+Plaintext[48]:
+| 0f 07 11 2c b8 e3 ec 50 08 bd 1a b9 cf ba 7b d0 |...,...P......{.|
+| 01 00 58 54 2e 7a c6 33 ab a7 5b 37 09 8a 94 d0 |..XT.z.3..[7....|
+| cb 6f 10 3f 65 6d 09 09 09 09 09 09 09 09 09 09 |.o.?em..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 58 54 2e 7a c6 33 ab a7 5b 37 09 8a 94 d0 cb 6f |XT.z.3..[7.....o|
+| 10 3f 65 6d |.?em |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #494 (first time)
+ conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ae 74 c4 5e 9b 94 79 8b 6d 4b 26 26 37 38 08 e8 |.t.^..y.mK&&78..|
+| cb 4a 9c 2b 93 d1 dd 00 9e e0 4c e8 46 f0 04 58 |.J.+......L.F..X|
+| c2 03 08 8a 81 b5 92 c8 4b c8 9f 48 68 b0 b6 35 |........K..Hh..5|
+Plaintext[48]:
+| c9 fb 6b 2b 8b a2 08 78 3d 09 57 72 d3 53 c0 72 |..k+...x=.Wr.S.r|
+| 01 00 f0 20 4e cb 04 0d 5e c0 6a fc c2 7f 25 0d |... N...^.j...%.|
+| 49 46 a8 ad dd 05 09 09 09 09 09 09 09 09 09 09 |IF..............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f0 20 4e cb 04 0d 5e c0 6a fc c2 7f 25 0d 49 46 |. N...^.j...%.IF|
+| a8 ad dd 05 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #4 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+
+dissect_ssl enter frame #6 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 9 offset 86 length 8168366 bytes, remaining 134
+
+dissect_ssl enter frame #128 (already visited)
+ conversation = 0x7fca71ded5c8, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 9 offset 186 length 12721791 bytes, remaining 234
+
+dissect_ssl enter frame #10 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 43113 found (nil)
+association_find: TCP port 4437 found 0x27eeca0
+
+dissect_ssl enter frame #11 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 4437 found 0x27eeca0
+
+dissect_ssl enter frame #12 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+
+dissect_ssl enter frame #14 (already visited)
+ conversation = 0x7fca71dec088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
diff --git a/tls/broken/dump.pcapng b/tls/broken/dump.pcapng
new file mode 100644
index 0000000..c7b26b6
--- /dev/null
+++ b/tls/broken/dump.pcapng
Binary files differ
diff --git a/tls/broken/premaster.txt b/tls/broken/premaster.txt
new file mode 100644
index 0000000..cc41345
--- /dev/null
+++ b/tls/broken/premaster.txt
@@ -0,0 +1,66 @@
+CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA
+CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C
+CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8
+CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1
+CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975
+CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557
+CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E
+CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774
+CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4
+CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C
+CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4
+CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87
+CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5
+CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0
+CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F
+CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6
+CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91
+CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B
+CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011
+CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D
+CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56
+CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960
+CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8
+CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164
+CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F
+CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F
+CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC
+CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7
+CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504
+CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F
+CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+CLIENT_RANDOM 5234c2f4ce9233b89dd4aa176a84fb68668eafad9e37a80a0ae9c289197e5f78 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E
+CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa2a080a0a12025372 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03
+CLIENT_RANDOM 5234c2f4b718c208219b56be7aa274e3f1f0bb1dff87bd24a2e166de81ffb60c 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03
+CLIENT_RANDOM 5234c2f4853355635cb2ab382ec6410b620603526b93a1192f960a1bcc403e50 D6DCD0ADA9C6F7D26DDACC44ADDF480E1524A7644FE45A4A0901DD107E02C63038147C8EE151C75832839B1677083D19
+CLIENT_RANDOM 5234c2f40a09b6fcf721c30506c8d64b449b2cd47380058c5c9169899237fea3 D6DCD0ADA9C6F7D26DDACC44ADDF480E1524A7644FE45A4A0901DD107E02C63038147C8EE151C75832839B1677083D19
diff --git a/tls/works/debug.txt b/tls/works/debug.txt
new file mode 100644
index 0000000..99bf4ef
--- /dev/null
+++ b/tls/works/debug.txt
@@ -0,0 +1,2685 @@
+Wireshark SSL debug log
+
+
+dissect_ssl enter frame #4 (first time)
+ssl_session_init: initializing ptr 0x7fb94d3c6060 size 688
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 40347 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4434
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #6 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session can't find stored session
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+found master secret in key log
+ cannot find master secret in keylog file either
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| ed 64 02 ea bf a6 51 b2 8a 7b 44 ed 8c ce 91 36 |.d....Q..{D....6|
+| 1d 01 45 ca 64 3f 91 d8 dd d9 d1 c8 ea 62 c2 38 |..E.d?.......b.8|
+| ba 78 14 6f b9 77 98 33 28 20 cd 9f 39 2a cf f8 |.x.o.w.3( ..9*..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6d 86 8d e8 40 97 da ee 7e 21 c4 1d 2e 9f e9 60 |m...@...~!.....`|
+| 5f 05 b0 ce af 7e b7 95 8c 33 42 3f d5 52 34 c6 |_....~...3B?.R4.|
+| 6d 51 c0 ad 1d 27 eb 8b e3 ed 76 ef e3 20 9e 04 |mQ...'....v.. ..|
+| bf 7d 80 68 42 d6 30 12 05 8e d5 0e 60 |.}.hB.0.....` |
+hash out[64]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+| 2a d2 9d 68 d8 4d fc b6 f8 ae f6 7d 29 23 7b 58 |*..h.M.....})#{X|
+| 73 d5 c9 e2 a2 cc b6 d3 a4 64 9e 1f 95 67 7f d6 |s........d...g..|
+PRF out[64]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+| 2a d2 9d 68 d8 4d fc b6 f8 ae f6 7d 29 23 7b 58 |*..h.M.....})#{X|
+| 73 d5 c9 e2 a2 cc b6 d3 a4 64 9e 1f 95 67 7f d6 |s........d...g..|
+key expansion[64]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+| 2a d2 9d 68 d8 4d fc b6 f8 ae f6 7d 29 23 7b 58 |*..h.M.....})#{X|
+| 73 d5 c9 e2 a2 cc b6 d3 a4 64 9e 1f 95 67 7f d6 |s........d...g..|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 2a d2 9d 68 d8 |*..h. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 c6 6d 51 c0 ad 1d 27 eb 8b e3 ed 76 ef e3 |R4.mQ...'....v..|
+| 20 9e 04 bf 7d 80 68 42 d6 30 12 05 8e d5 0e 60 | ...}.hB.0.....`|
+| 52 34 c6 6d 86 8d e8 40 97 da ee 7e 21 c4 1d 2e |R4.m...@...~!...|
+| 9f e9 60 5f 05 b0 ce af 7e b7 95 8c 33 42 3f d5 |..`_....~...3B?.|
+hash out[32]:
+| f6 18 55 a9 d8 a5 1f e2 96 e5 02 ff 4d 42 92 12 |..U.........MB..|
+| 1b 9f e0 5e 3f 41 c2 cc b2 f4 b2 24 73 26 c3 34 |...^?A.....$s&.4|
+PRF out[32]:
+| f6 18 55 a9 d8 a5 1f e2 96 e5 02 ff 4d 42 92 12 |..U.........MB..|
+| 1b 9f e0 5e 3f 41 c2 cc b2 f4 b2 24 73 26 c3 34 |...^?A.....$s&.4|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 4d fc b6 f8 ae |M.... |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 c6 6d 51 c0 ad 1d 27 eb 8b e3 ed 76 ef e3 |R4.mQ...'....v..|
+| 20 9e 04 bf 7d 80 68 42 d6 30 12 05 8e d5 0e 60 | ...}.hB.0.....`|
+| 52 34 c6 6d 86 8d e8 40 97 da ee 7e 21 c4 1d 2e |R4.m...@...~!...|
+| 9f e9 60 5f 05 b0 ce af 7e b7 95 8c 33 42 3f d5 |..`_....~...3B?.|
+hash out[32]:
+| 00 a7 c6 ef c0 d2 8b d1 78 25 98 b9 e9 d9 de f7 |........x%......|
+| e5 b1 a7 86 b4 0b 6e 6b 9d e6 9f 66 e6 03 1a 15 |......nk...f....|
+PRF out[32]:
+| 00 a7 c6 ef c0 d2 8b d1 78 25 98 b9 e9 d9 de f7 |........x%......|
+| e5 b1 a7 86 b4 0b 6e 6b 9d e6 9f 66 e6 03 1a 15 |......nk...f....|
+Client MAC key[16]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+Server MAC key[16]:
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+Client Write key[16]:
+| f6 18 55 a9 d8 a5 1f e2 96 e5 02 ff 4d 42 92 12 |..U.........MB..|
+Server Write key[16]:
+| 00 a7 c6 ef c0 d2 8b d1 78 25 98 b9 e9 d9 de f7 |........x%......|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 52 11 00 00 00 00 00 00 |R....... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842...
+looking for RSA pre-master16d2f55f7a48600295b03b793d314964da596512daf0f864...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| ed 64 02 ea bf a6 51 b2 8a 7b 44 ed 8c ce 91 36 |.d....Q..{D....6|
+| 1d 01 45 ca 64 3f 91 d8 dd d9 d1 c8 ea 62 c2 38 |..E.d?.......b.8|
+| ba 78 14 6f b9 77 98 33 28 20 cd 9f 39 2a cf f8 |.x.o.w.3( ..9*..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6d 86 8d e8 40 97 da ee 7e 21 c4 1d 2e 9f e9 60 |m...@...~!.....`|
+| 5f 05 b0 ce af 7e b7 95 8c 33 42 3f d5 52 34 c6 |_....~...3B?.R4.|
+| 6d 51 c0 ad 1d 27 eb 8b e3 ed 76 ef e3 20 9e 04 |mQ...'....v.. ..|
+| bf 7d 80 68 42 d6 30 12 05 8e d5 0e 60 |.}.hB.0.....` |
+hash out[64]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+| 2a d2 9d 68 d8 4d fc b6 f8 ae f6 7d 29 23 7b 58 |*..h.M.....})#{X|
+| 73 d5 c9 e2 a2 cc b6 d3 a4 64 9e 1f 95 67 7f d6 |s........d...g..|
+PRF out[64]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+| 2a d2 9d 68 d8 4d fc b6 f8 ae f6 7d 29 23 7b 58 |*..h.M.....})#{X|
+| 73 d5 c9 e2 a2 cc b6 d3 a4 64 9e 1f 95 67 7f d6 |s........d...g..|
+key expansion[64]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+| 2a d2 9d 68 d8 4d fc b6 f8 ae f6 7d 29 23 7b 58 |*..h.M.....})#{X|
+| 73 d5 c9 e2 a2 cc b6 d3 a4 64 9e 1f 95 67 7f d6 |s........d...g..|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 2a d2 9d 68 d8 |*..h. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 c6 6d 51 c0 ad 1d 27 eb 8b e3 ed 76 ef e3 |R4.mQ...'....v..|
+| 20 9e 04 bf 7d 80 68 42 d6 30 12 05 8e d5 0e 60 | ...}.hB.0.....`|
+| 52 34 c6 6d 86 8d e8 40 97 da ee 7e 21 c4 1d 2e |R4.m...@...~!...|
+| 9f e9 60 5f 05 b0 ce af 7e b7 95 8c 33 42 3f d5 |..`_....~...3B?.|
+hash out[32]:
+| f6 18 55 a9 d8 a5 1f e2 96 e5 02 ff 4d 42 92 12 |..U.........MB..|
+| 1b 9f e0 5e 3f 41 c2 cc b2 f4 b2 24 73 26 c3 34 |...^?A.....$s&.4|
+PRF out[32]:
+| f6 18 55 a9 d8 a5 1f e2 96 e5 02 ff 4d 42 92 12 |..U.........MB..|
+| 1b 9f e0 5e 3f 41 c2 cc b2 f4 b2 24 73 26 c3 34 |...^?A.....$s&.4|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 4d fc b6 f8 ae |M.... |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 c6 6d 51 c0 ad 1d 27 eb 8b e3 ed 76 ef e3 |R4.mQ...'....v..|
+| 20 9e 04 bf 7d 80 68 42 d6 30 12 05 8e d5 0e 60 | ...}.hB.0.....`|
+| 52 34 c6 6d 86 8d e8 40 97 da ee 7e 21 c4 1d 2e |R4.m...@...~!...|
+| 9f e9 60 5f 05 b0 ce af 7e b7 95 8c 33 42 3f d5 |..`_....~...3B?.|
+hash out[32]:
+| 00 a7 c6 ef c0 d2 8b d1 78 25 98 b9 e9 d9 de f7 |........x%......|
+| e5 b1 a7 86 b4 0b 6e 6b 9d e6 9f 66 e6 03 1a 15 |......nk...f....|
+PRF out[32]:
+| 00 a7 c6 ef c0 d2 8b d1 78 25 98 b9 e9 d9 de f7 |........x%......|
+| e5 b1 a7 86 b4 0b 6e 6b 9d e6 9f 66 e6 03 1a 15 |......nk...f....|
+Client MAC key[16]:
+| 88 48 e5 50 2c 0b 2b 67 dd 0f f0 ea db 12 1e 9b |.H.P,.+g........|
+Server MAC key[16]:
+| 01 b9 55 f9 6b 64 3f 43 9b 4b 27 68 a2 3e 81 ef |..U.kd?C.K'h.>..|
+Client Write key[16]:
+| f6 18 55 a9 d8 a5 1f e2 96 e5 02 ff 4d 42 92 12 |..U.........MB..|
+Server Write key[16]:
+| 00 a7 c6 ef c0 d2 8b d1 78 25 98 b9 e9 d9 de f7 |........x%......|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 33 72 03 00 00 00 00 | 3r..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| ed 64 02 ea bf a6 51 b2 8a 7b 44 ed 8c ce 91 36 |.d....Q..{D....6|
+| 1d 01 45 ca 64 3f 91 d8 dd d9 d1 c8 ea 62 c2 38 |..E.d?.......b.8|
+| ba 78 14 6f b9 77 98 33 28 20 cd 9f 39 2a cf f8 |.x.o.w.3( ..9*..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 0c 86 a2 bc de 0d 24 3b 1d 1c 56 b8 d3 e9 73 05 |......$;..V...s.|
+| ef 05 0a db 68 49 61 31 80 40 7b 58 62 30 ab 88 |....hIa1.@{Xb0..|
+Plaintext[32]:
+| 14 00 00 0c 8b 25 2d b9 b2 dd 96 62 d4 df 11 af |.....%-....b....|
+| 99 f6 61 40 fd e5 7f 7d 95 f5 9b a6 24 2a e0 28 |..a@...}....$*.(|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 99 f6 61 40 fd e5 7f 7d 95 f5 9b a6 24 2a e0 28 |..a@...}....$*.(|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 86 fb 19 42 20 48 8f e1 9a ca 86 72 f7 a0 1e 13 |...B H.....r....|
+| 64 83 8e ac 3b 78 41 28 08 d8 c5 d5 e3 99 69 29 |d...;xA(......i)|
+Plaintext[32]:
+| 14 00 00 0c 4b dc 35 37 6a 7a 28 83 2b 72 4e 1d |....K.57jz(.+rN.|
+| 57 c0 31 5f ae fa 7b 9b 9e 78 9e bc 53 9b fd 75 |W.1_..{..x..S..u|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 57 c0 31 5f ae fa 7b 9b 9e 78 9e bc 53 9b fd 75 |W.1_..{..x..S..u|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| ad 37 80 c8 d6 8e 5a 85 2b b4 ad 33 89 9d 47 d5 |.7....Z.+..3..G.|
+| d6 d6 34 87 6f ac 85 f6 10 df 66 1f f4 01 a4 00 |..4.o.....f.....|
+| 60 ed 73 e6 bf 68 7a 36 64 b5 4a 7e 7f 09 fb cc |`.s..hz6d.J~....|
+| 37 e7 1b 0b c4 78 05 7b e4 e9 e9 3d 82 98 da 03 |7....x.{...=....|
+| d4 a0 4e 27 83 75 cf 75 c9 64 31 6c 77 36 11 cf |..N'.u.u.d1lw6..|
+| 57 |W |
+ssl_decrypt_record: allocating 113 bytes for decrypt data (old len 32)
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a 0e f7 5e 2b 02 b1 83 6b 04 9b 7f f5 55 a5 77 |...^+...k....U.w|
+| 99 |. |
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0e f7 5e 2b 02 b1 83 6b 04 9b 7f f5 55 a5 77 99 |..^+...k....U.w.|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65
+association_find: TCP port 40347 found (nil)
+association_find: TCP port 4434 found 0x33e0300
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33e0300
+
+dissect_ssl enter frame #11 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 371, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 371
+Ciphertext[371]:
+| cc 91 10 b8 90 cc 5e 8d 25 8b fd fe c2 20 24 55 |......^.%.... $U|
+| 81 95 ce 5d 0a 15 00 55 2d 51 93 a8 06 9a f6 ad |...]...U-Q......|
+| b1 f5 65 38 ef a9 ec d2 ea 31 f0 36 e5 55 16 64 |..e8.....1.6.U.d|
+| 10 7a be e9 7a 86 fe 86 42 2d e0 54 51 7a d2 d2 |.z..z...B-.TQz..|
+| 8c 26 bc 7d f4 31 68 84 da d5 d1 e0 7c f5 8d b0 |.&.}.1h.....|...|
+| 95 23 26 cf 3f a2 8e 99 47 72 70 52 06 c0 e6 a0 |.#&.?...GrpR....|
+| ba 7e b6 88 b4 ac 22 8e dc fb b5 2e 42 41 68 97 |.~....".....BAh.|
+| d7 43 88 3b fb b5 1d 88 35 71 b9 8a 4b 13 42 41 |.C.;....5q..K.BA|
+| ce 25 7b 28 9a 9c 42 cf 10 5c 33 b1 18 36 21 50 |.%{(..B..\3..6!P|
+| 32 7d 23 c4 eb 72 46 28 6b 0e f3 34 87 62 86 80 |2}#..rF(k..4.b..|
+| 48 05 5e 3b 16 ce 79 e5 72 40 2a 98 05 c1 64 ac |H.^;..y.r@*...d.|
+| fc d1 a2 4c 0e 9f a9 29 59 db b8 c1 70 8b 61 5c |...L...)Y...p.a\|
+| 03 9f 35 32 81 22 f3 f6 3c 94 26 7a 9b 54 d6 c0 |..52."..<.&z.T..|
+| 79 8e da 0f 0a ec 69 6d d8 20 c1 e4 a6 8e 32 38 |y.....im. ....28|
+| f9 83 bc 24 bb 2d b4 fa 93 42 dc 28 14 ab a9 a0 |...$.-...B.(....|
+| a3 b7 1a 26 bd 94 21 99 c2 f8 63 67 58 13 af 31 |...&..!...cgX..1|
+| 2b a8 24 2c 26 74 db 2a 8a ed b6 c3 9d 8c 9b fb |+.$,&t.*........|
+| 9c f7 35 da b2 0d 6a 0d 1e 47 98 7d 59 77 c9 04 |..5...j..G.}Yw..|
+| bc 6b 23 3b 34 2d dc b1 dc e0 12 4d 8f 3b 94 8e |.k#;4-.....M.;..|
+| ae 04 3a 7f 81 77 29 9c 36 ae cb 38 82 23 34 4c |..:..w).6..8.#4L|
+| 26 47 66 1e a4 98 30 09 ef 04 e4 20 0c a0 8d 20 |&Gf...0.... ... |
+| 04 30 2b 89 fd 8b 4e a5 c1 89 94 26 9c 8d ff 20 |.0+...N....&... |
+| d0 4a 94 ca 14 77 83 82 3e f9 20 ea f6 79 dd d1 |.J...w..>. ..y..|
+| 91 07 c4 |... |
+ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 113)
+Plaintext[371]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e 52 51 48 de ac 5f a5 8b e5 e5 c1 f4 cc |pt>RQH.._.......|
+| 1a 50 21 |.P! |
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 52 51 48 de ac 5f a5 8b e5 e5 c1 f4 cc 1a 50 21 |RQH.._........P!|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355
+association_find: TCP port 4434 found 0x33e0300
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33e0300
+
+dissect_ssl enter frame #12 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| da b3 f2 c9 8c 3c 23 e7 0f 61 46 08 02 c1 14 ec |.....<#..aF.....|
+| 01 67 |.g |
+Plaintext[18]:
+| 01 00 7b 80 f5 df 00 d8 f2 a8 02 b5 7a 7e fc be |..{.........z~..|
+| 3f e2 |?. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 7b 80 f5 df 00 d8 f2 a8 02 b5 7a 7e fc be 3f e2 |{.........z~..?.|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #14 (first time)
+ conversation = 0x7fb97956b088, ssl_session = 0x7fb94d3c6060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 3e 1c db e3 72 3b 7c 18 86 42 c6 6f 1b 27 31 c3 |>...r;|..B.o.'1.|
+| 41 bb |A. |
+Plaintext[18]:
+| 01 00 2c 86 c2 ee 63 29 9a ec dc 1a 88 62 52 cb |..,...c).....bR.|
+| b0 63 |.c |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 2c 86 c2 ee 63 29 9a ec dc 1a 88 62 52 cb b0 63 |,...c).....bR..c|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #19 (first time)
+ssl_session_init: initializing ptr 0x7fb94d3c8990 size 688
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46377 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4435
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #21 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| ed 64 02 ea bf a6 51 b2 8a 7b 44 ed 8c ce 91 36 |.d....Q..{D....6|
+| 1d 01 45 ca 64 3f 91 d8 dd d9 d1 c8 ea 62 c2 38 |..E.d?.......b.8|
+| ba 78 14 6f b9 77 98 33 28 20 cd 9f 39 2a cf f8 |.x.o.w.3( ..9*..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e d7 43 1a d3 74 c1 69 9d 8f 91 1d 24 10 70 e4 |n.C..t.i....$.p.|
+| af d8 fb a7 c6 97 ae 5c 8f a1 2e c1 84 52 34 c6 |.......\.....R4.|
+| 6e 95 f5 27 0d 00 e9 73 70 9a a0 b3 db d5 2a 80 |n..'...sp.....*.|
+| 23 ca c5 5f f8 ff 18 26 2a b2 27 e6 98 |#.._...&*.'.. |
+hash out[64]:
+| 75 9d 34 2a 45 d0 b5 fe ba 21 1c 76 e1 6a f9 8e |u.4*E....!.v.j..|
+| f0 d3 df 8d 29 15 15 6a a8 87 61 49 f8 44 7e be |....)..j..aI.D~.|
+| 5e 80 2f 32 a8 36 cf 38 46 e4 98 ce 94 2b 9e 84 |^./2.6.8F....+..|
+| 38 66 f5 b0 0f 16 2c df 3e 2f 61 fb 4a 44 ce ef |8f....,.>/a.JD..|
+PRF out[64]:
+| 75 9d 34 2a 45 d0 b5 fe ba 21 1c 76 e1 6a f9 8e |u.4*E....!.v.j..|
+| f0 d3 df 8d 29 15 15 6a a8 87 61 49 f8 44 7e be |....)..j..aI.D~.|
+| 5e 80 2f 32 a8 36 cf 38 46 e4 98 ce 94 2b 9e 84 |^./2.6.8F....+..|
+| 38 66 f5 b0 0f 16 2c df 3e 2f 61 fb 4a 44 ce ef |8f....,.>/a.JD..|
+key expansion[64]:
+| 75 9d 34 2a 45 d0 b5 fe ba 21 1c 76 e1 6a f9 8e |u.4*E....!.v.j..|
+| f0 d3 df 8d 29 15 15 6a a8 87 61 49 f8 44 7e be |....)..j..aI.D~.|
+| 5e 80 2f 32 a8 36 cf 38 46 e4 98 ce 94 2b 9e 84 |^./2.6.8F....+..|
+| 38 66 f5 b0 0f 16 2c df 3e 2f 61 fb 4a 44 ce ef |8f....,.>/a.JD..|
+Client MAC key[16]:
+| 75 9d 34 2a 45 d0 b5 fe ba 21 1c 76 e1 6a f9 8e |u.4*E....!.v.j..|
+Server MAC key[16]:
+| f0 d3 df 8d 29 15 15 6a a8 87 61 49 f8 44 7e be |....)..j..aI.D~.|
+Client Write key[16]:
+| 5e 80 2f 32 a8 36 cf 38 46 e4 98 ce 94 2b 9e 84 |^./2.6.8F....+..|
+Server Write key[16]:
+| 38 66 f5 b0 0f 16 2c df 3e 2f 61 fb 4a 44 ce ef |8f....,.>/a.JD..|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 60 e5 01 00 00 00 00 00 |`....... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #23 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 310
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8...
+looking for RSA pre-master5c7d85e3e032812cad681d5e723f7c6f8dcc01f2a94eeb76...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8ff18262ab227e698 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 32 58 f4 4e b7 00 be 97 76 40 04 ac 92 33 9c ad |2X.N....v@...3..|
+| a4 3e 24 15 9e 56 7b 8d 41 69 ad bb c6 48 5f 75 |.>$..V{.Ai...H_u|
+| 6c 51 f9 52 72 0b 99 fc 81 e1 6f d7 5c a8 86 dc |lQ.Rr.....o.\...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e d7 43 1a d3 74 c1 69 9d 8f 91 1d 24 10 70 e4 |n.C..t.i....$.p.|
+| af d8 fb a7 c6 97 ae 5c 8f a1 2e c1 84 52 34 c6 |.......\.....R4.|
+| 6e 95 f5 27 0d 00 e9 73 70 9a a0 b3 db d5 2a 80 |n..'...sp.....*.|
+| 23 ca c5 5f f8 ff 18 26 2a b2 27 e6 98 |#.._...&*.'.. |
+hash out[64]:
+| da 31 4d ea 7a 15 1d 4b 84 5d b2 ff 1d 49 9e 57 |.1M.z..K.]...I.W|
+| 04 6d 33 99 10 0a 59 46 99 8c 9d fb 9d ac 0a 6f |.m3...YF.......o|
+| b2 4b 4b 1a e5 4a 4c 32 fb 82 c5 31 6b f0 74 80 |.KK..JL2...1k.t.|
+| 84 a9 91 7d eb b4 b1 66 d5 64 4b da b2 d3 91 90 |...}...f.dK.....|
+PRF out[64]:
+| da 31 4d ea 7a 15 1d 4b 84 5d b2 ff 1d 49 9e 57 |.1M.z..K.]...I.W|
+| 04 6d 33 99 10 0a 59 46 99 8c 9d fb 9d ac 0a 6f |.m3...YF.......o|
+| b2 4b 4b 1a e5 4a 4c 32 fb 82 c5 31 6b f0 74 80 |.KK..JL2...1k.t.|
+| 84 a9 91 7d eb b4 b1 66 d5 64 4b da b2 d3 91 90 |...}...f.dK.....|
+key expansion[64]:
+| da 31 4d ea 7a 15 1d 4b 84 5d b2 ff 1d 49 9e 57 |.1M.z..K.]...I.W|
+| 04 6d 33 99 10 0a 59 46 99 8c 9d fb 9d ac 0a 6f |.m3...YF.......o|
+| b2 4b 4b 1a e5 4a 4c 32 fb 82 c5 31 6b f0 74 80 |.KK..JL2...1k.t.|
+| 84 a9 91 7d eb b4 b1 66 d5 64 4b da b2 d3 91 90 |...}...f.dK.....|
+Client MAC key[16]:
+| da 31 4d ea 7a 15 1d 4b 84 5d b2 ff 1d 49 9e 57 |.1M.z..K.]...I.W|
+Server MAC key[16]:
+| 04 6d 33 99 10 0a 59 46 99 8c 9d fb 9d ac 0a 6f |.m3...YF.......o|
+Client Write key[16]:
+| b2 4b 4b 1a e5 4a 4c 32 fb 82 c5 31 6b f0 74 80 |.KK..JL2...1k.t.|
+Server Write key[16]:
+| 84 a9 91 7d eb b4 b1 66 d5 64 4b da b2 d3 91 90 |...}...f.dK.....|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 35 72 03 00 00 00 00 |@5r..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 32 58 f4 4e b7 00 be 97 76 40 04 ac 92 33 9c ad |2X.N....v@...3..|
+| a4 3e 24 15 9e 56 7b 8d 41 69 ad bb c6 48 5f 75 |.>$..V{.Ai...H_u|
+| 6c 51 f9 52 72 0b 99 fc 81 e1 6f d7 5c a8 86 dc |lQ.Rr.....o.\...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| cd 13 7c 44 06 c1 d8 20 05 68 18 b9 19 de fa 2c |..|D... .h.....,|
+| fc 7f 56 52 9e fa dd 4d f0 66 f6 2b 82 74 35 c8 |..VR...M.f.+.t5.|
+Plaintext[32]:
+| 14 00 00 0c 1c c5 ec 96 91 37 21 ff b5 78 8b 2c |.........7!..x.,|
+| 9a 85 7c 30 84 d1 50 9e 7c 94 20 06 eb 82 a0 b5 |..|0..P.|. .....|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 9a 85 7c 30 84 d1 50 9e 7c 94 20 06 eb 82 a0 b5 |..|0..P.|. .....|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #24 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 37 a4 a3 75 8d 1d 58 aa 31 e1 9a ee ce 24 67 90 |7..u..X.1....$g.|
+| d7 e8 17 68 54 f3 2a 3f 6e bb 0f 3a 09 bd 6d f5 |...hT.*?n..:..m.|
+Plaintext[32]:
+| 14 00 00 0c 26 c6 0d b2 a4 e4 c2 16 2f dc 1b be |....&......./...|
+| b5 5b 3e 15 e5 0a ff 69 76 a9 a6 e4 9a ee ea eb |.[>....iv.......|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| b5 5b 3e 15 e5 0a ff 69 76 a9 a6 e4 9a ee ea eb |.[>....iv.......|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #25 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 82
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 77, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 77
+Ciphertext[77]:
+| 80 11 09 85 d8 83 32 e1 3e a9 fc 2c 6c 54 e3 04 |......2.>..,lT..|
+| ed 3e ec 67 32 db c4 98 61 87 84 97 5d a5 c0 10 |.>.g2...a...]...|
+| 7b a3 6a 5d 1a 3a 10 cb d7 1b 6d ca 84 18 e2 ec |{.j].:....m.....|
+| 16 45 42 25 cb cf 97 21 4b 17 6c 6c 5a 4c db a2 |.EB%...!K.llZL..|
+| 5d c5 79 64 8f c5 48 55 6e 8e a6 d0 5b |].yd..HUn...[ |
+Plaintext[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a df 81 bb |n.nl:4435.......|
+| cf b7 ed 05 96 13 fa 20 77 15 a8 f4 5f |....... w..._ |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| df 81 bb cf b7 ed 05 96 13 fa 20 77 15 a8 f4 5f |.......... w..._|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 46377 found (nil)
+association_find: TCP port 4435 found 0x340ba90
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... |
+dissect_ssl3_record found association 0x340ba90
+
+dissect_ssl enter frame #26 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 368
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 363, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 363
+Ciphertext[363]:
+| 9d 31 a9 72 6f 31 65 cc e6 0f dd 06 e9 c4 90 46 |.1.ro1e........F|
+| bf e9 b2 ff 35 5d ad 46 f0 94 78 48 8b 35 c3 b7 |....5].F..xH.5..|
+| ee 74 62 6c 42 68 91 39 4b 6e e2 18 eb 9b 3b 86 |.tblBh.9Kn....;.|
+| 08 40 0a 6a 2a 52 68 14 45 9d 2b 68 6c 82 c3 df |.@.j*Rh.E.+hl...|
+| e2 1e 02 f5 2f 73 4e 2c 01 72 35 7d bd 5c 82 84 |..../sN,.r5}.\..|
+| c4 9e 8b f2 68 0c df 27 43 1e 3d d8 90 37 a6 0b |....h..'C.=..7..|
+| 49 65 15 16 de 89 a1 68 be 58 b5 13 8f 8e ea e5 |Ie.....h.X......|
+| f1 1e bf e5 76 73 f5 f8 a3 98 17 01 ed 26 92 2f |....vs.......&./|
+| 82 d2 26 57 b0 25 5e f5 80 d0 8b c9 c0 50 a4 f9 |..&W.%^......P..|
+| 1e a9 a6 fd 68 51 4b 03 31 ca 66 64 6b 99 e4 92 |....hQK.1.fdk...|
+| 30 5d e0 40 54 53 a9 17 7d 6a 29 03 78 46 0f 54 |0].@TS..}j).xF.T|
+| e5 da b9 26 09 1b 1f d5 91 d7 c8 27 74 ab 5a d4 |...&.......'t.Z.|
+| 08 d3 4a 68 fc 66 8c d5 04 17 fc 26 29 d7 f4 e6 |..Jh.f.....&)...|
+| 8c 36 cc f0 36 4e 58 92 39 2e 7f 02 5c 0e 14 f7 |.6..6NX.9...\...|
+| 71 36 4a 52 77 66 c5 bf ce 6d b4 ae 1a 6a a4 c3 |q6JRwf...m...j..|
+| 34 c2 ad e2 e0 b2 bd c4 40 80 2c 75 30 b4 d7 ca |4.......@.,u0...|
+| e9 43 23 b9 df f8 83 ec 4c 39 0c 57 ca b9 be 93 |.C#.....L9.W....|
+| a4 72 b8 50 ad 70 e1 0d a8 06 be 5c fb 49 eb 20 |.r.P.p.....\.I. |
+| 91 8c 13 b4 20 d3 85 be f3 7b ef fa d6 70 fa 7e |.... ....{...p.~|
+| 02 55 69 2e a2 48 2c ff 43 95 a8 4e ce 77 04 3f |.Ui..H,.C..N.w.?|
+| cc 33 58 1a 48 0e 61 09 e2 01 dc ae 0a e2 21 bd |.3X.H.a.......!.|
+| cd c1 45 41 fa 1d c6 b4 59 54 d7 ea 14 b8 17 e9 |..EA....YT......|
+| 4e f2 e3 1d 3e df 76 62 76 0d 56 |N...>.vbv.V |
+Plaintext[363]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 4b 9b 38 c6 65 |l'</script>K.8.e|
+| 25 b2 1d 2b 29 2c ec 29 84 d6 e4 |%..+),.)... |
+checking mac (len 347, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 4b 9b 38 c6 65 25 b2 1d 2b 29 2c ec 29 84 d6 e4 |K.8.e%..+),.)...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347
+association_find: TCP port 4435 found 0x340ba90
+dissect_ssl3_record decrypted len 347
+decrypted app data fragment[347]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e |l'</script> |
+dissect_ssl3_record found association 0x340ba90
+
+dissect_ssl enter frame #27 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 8b d3 bc 5f 0f 8a 63 dc 48 90 44 36 0c 5f 4a 4b |..._..c.H.D6._JK|
+| de e7 |.. |
+Plaintext[18]:
+| 01 00 eb 37 74 a3 74 7b 97 70 36 84 93 d4 35 8d |...7t.t{.p6...5.|
+| 48 fa |H. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| eb 37 74 a3 74 7b 97 70 36 84 93 d4 35 8d 48 fa |.7t.t{.p6...5.H.|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #29 (first time)
+ conversation = 0x7fb97956b3d8, ssl_session = 0x7fb94d3c8990
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| c2 00 b3 23 f2 b1 5c ce 4e 36 34 da 09 d9 db a8 |...#..\.N64.....|
+| 96 aa |.. |
+Plaintext[18]:
+| 01 00 ff 5e c9 f6 a9 91 d0 5d be 8a 25 01 90 f0 |...^.....]..%...|
+| e0 1e |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| ff 5e c9 f6 a9 91 d0 5d be 8a 25 01 90 f0 e0 1e |.^.....]..%.....|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #34 (first time)
+ssl_session_init: initializing ptr 0x7fb94d3cb310 size 688
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52730 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4436
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #36 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 32 58 f4 4e b7 00 be 97 76 40 04 ac 92 33 9c ad |2X.N....v@...3..|
+| a4 3e 24 15 9e 56 7b 8d 41 69 ad bb c6 48 5f 75 |.>$..V{.Ai...H_u|
+| 6c 51 f9 52 72 0b 99 fc 81 e1 6f d7 5c a8 86 dc |lQ.Rr.....o.\...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e 03 5f 0c dd bb 9b 4d 52 be c2 3d 49 e5 86 91 |n._....MR..=I...|
+| e0 cc e1 bd e6 b4 de d5 68 c8 c8 2a 76 52 34 c6 |........h..*vR4.|
+| 6e ee 73 fe a2 1e b7 ef 62 cf 26 4d 20 5d 6f cd |n.s.....b.&M ]o.|
+| 78 41 f9 49 ad f8 0b c6 c7 03 e4 c2 64 |xA.I........d |
+hash out[72]:
+| 66 30 c5 84 9b 9c aa cf fa ed d5 87 32 b0 86 f8 |f0..........2...|
+| 92 a4 b2 4a e4 22 d2 1a 53 22 39 3d 08 18 e6 10 |...J."..S"9=....|
+| ba 42 47 a2 b6 eb df 73 9a 0a 86 f4 b7 b7 70 a5 |.BG....s......p.|
+| 50 e5 77 82 fa 0f 72 b9 8a 94 32 33 a1 ca 17 0d |P.w...r...23....|
+| 16 5f 58 ed 13 27 6b 2c |._X..'k, |
+PRF out[72]:
+| 66 30 c5 84 9b 9c aa cf fa ed d5 87 32 b0 86 f8 |f0..........2...|
+| 92 a4 b2 4a e4 22 d2 1a 53 22 39 3d 08 18 e6 10 |...J."..S"9=....|
+| ba 42 47 a2 b6 eb df 73 9a 0a 86 f4 b7 b7 70 a5 |.BG....s......p.|
+| 50 e5 77 82 fa 0f 72 b9 8a 94 32 33 a1 ca 17 0d |P.w...r...23....|
+| 16 5f 58 ed 13 27 6b 2c |._X..'k, |
+key expansion[72]:
+| 66 30 c5 84 9b 9c aa cf fa ed d5 87 32 b0 86 f8 |f0..........2...|
+| 92 a4 b2 4a e4 22 d2 1a 53 22 39 3d 08 18 e6 10 |...J."..S"9=....|
+| ba 42 47 a2 b6 eb df 73 9a 0a 86 f4 b7 b7 70 a5 |.BG....s......p.|
+| 50 e5 77 82 fa 0f 72 b9 8a 94 32 33 a1 ca 17 0d |P.w...r...23....|
+| 16 5f 58 ed 13 27 6b 2c |._X..'k, |
+Client MAC key[20]:
+| 66 30 c5 84 9b 9c aa cf fa ed d5 87 32 b0 86 f8 |f0..........2...|
+| 92 a4 b2 4a |...J |
+Server MAC key[20]:
+| e4 22 d2 1a 53 22 39 3d 08 18 e6 10 ba 42 47 a2 |."..S"9=.....BG.|
+| b6 eb df 73 |...s |
+Client Write key[16]:
+| 9a 0a 86 f4 b7 b7 70 a5 50 e5 77 82 fa 0f 72 b9 |......p.P.w...r.|
+Server Write key[16]:
+| 8a 94 32 33 a1 ca 17 0d 16 5f 58 ed 13 27 6b 2c |..23....._X..'k,|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #38 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 314
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66eee73fea21eb7ef62cf264d205d6fcd7841f949ad...
+looking for RSA pre-master81b73b11c7b8f3cdc9b65b236e4d4f630477be9fc85f6b31...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8ff18262ab227e698 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed7431ad374c1699d8f911d241070e4afd8fba7c697ae5c8fa12ec184 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66eee73fea21eb7ef62cf264d205d6fcd7841f949adf80bc6c703e4c264 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 73 72 51 78 33 5f 5d ff 05 25 c6 48 0d c4 a0 ef |srQx3_]..%.H....|
+| 91 70 69 e4 18 dd 54 16 7a 64 c2 67 d9 3c 5b 64 |.pi...T.zd.g.<[d|
+| 08 83 a2 c8 0b 60 d4 50 1f 40 e4 42 86 c1 bf 98 |.....`.P.@.B....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e 03 5f 0c dd bb 9b 4d 52 be c2 3d 49 e5 86 91 |n._....MR..=I...|
+| e0 cc e1 bd e6 b4 de d5 68 c8 c8 2a 76 52 34 c6 |........h..*vR4.|
+| 6e ee 73 fe a2 1e b7 ef 62 cf 26 4d 20 5d 6f cd |n.s.....b.&M ]o.|
+| 78 41 f9 49 ad f8 0b c6 c7 03 e4 c2 64 |xA.I........d |
+hash out[72]:
+| d4 51 c0 30 7b 66 00 43 ea 28 07 d2 6f be 0d 76 |.Q.0{f.C.(..o..v|
+| aa 64 01 73 03 6d 4d 70 ad e3 ff 20 9f 04 ef b3 |.d.s.mMp... ....|
+| 15 5a bf ca 6e 9f 2f a9 80 3a 86 f8 5f 45 9c 1c |.Z..n./..:.._E..|
+| 2c 55 cf d1 9c d3 94 8b fb 82 d7 a2 18 e9 ba 36 |,U.............6|
+| 28 0b 13 72 96 1b 2e 90 |(..r.... |
+PRF out[72]:
+| d4 51 c0 30 7b 66 00 43 ea 28 07 d2 6f be 0d 76 |.Q.0{f.C.(..o..v|
+| aa 64 01 73 03 6d 4d 70 ad e3 ff 20 9f 04 ef b3 |.d.s.mMp... ....|
+| 15 5a bf ca 6e 9f 2f a9 80 3a 86 f8 5f 45 9c 1c |.Z..n./..:.._E..|
+| 2c 55 cf d1 9c d3 94 8b fb 82 d7 a2 18 e9 ba 36 |,U.............6|
+| 28 0b 13 72 96 1b 2e 90 |(..r.... |
+key expansion[72]:
+| d4 51 c0 30 7b 66 00 43 ea 28 07 d2 6f be 0d 76 |.Q.0{f.C.(..o..v|
+| aa 64 01 73 03 6d 4d 70 ad e3 ff 20 9f 04 ef b3 |.d.s.mMp... ....|
+| 15 5a bf ca 6e 9f 2f a9 80 3a 86 f8 5f 45 9c 1c |.Z..n./..:.._E..|
+| 2c 55 cf d1 9c d3 94 8b fb 82 d7 a2 18 e9 ba 36 |,U.............6|
+| 28 0b 13 72 96 1b 2e 90 |(..r.... |
+Client MAC key[20]:
+| d4 51 c0 30 7b 66 00 43 ea 28 07 d2 6f be 0d 76 |.Q.0{f.C.(..o..v|
+| aa 64 01 73 |.d.s |
+Server MAC key[20]:
+| 03 6d 4d 70 ad e3 ff 20 9f 04 ef b3 15 5a bf ca |.mMp... .....Z..|
+| 6e 9f 2f a9 |n./. |
+Client Write key[16]:
+| 80 3a 86 f8 5f 45 9c 1c 2c 55 cf d1 9c d3 94 8b |.:.._E..,U......|
+Server Write key[16]:
+| fb 82 d7 a2 18 e9 ba 36 28 0b 13 72 96 1b 2e 90 |.......6(..r....|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 33 72 03 00 00 00 00 | 3r..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 73 72 51 78 33 5f 5d ff 05 25 c6 48 0d c4 a0 ef |srQx3_]..%.H....|
+| 91 70 69 e4 18 dd 54 16 7a 64 c2 67 d9 3c 5b 64 |.pi...T.zd.g.<[d|
+| 08 83 a2 c8 0b 60 d4 50 1f 40 e4 42 86 c1 bf 98 |.....`.P.@.B....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 9a 28 45 a2 18 36 ca df 0f 06 cb e1 f8 ac 1f 72 |.(E..6.........r|
+| 61 fc cd e5 e8 4a 59 be 88 23 ba b9 ce 01 22 4b |a....JY..#...."K|
+| 26 c2 b7 4b |&..K |
+Plaintext[36]:
+| 14 00 00 0c a8 e5 48 ad 86 e9 b3 0a 61 aa 2e f0 |......H.....a...|
+| 68 8f 93 ca 4c 02 35 40 cc eb de bb 03 cf 4c 53 |h...L.5@......LS|
+| ff 57 38 58 |.W8X |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 68 8f 93 ca 4c 02 35 40 cc eb de bb 03 cf 4c 53 |h...L.5@......LS|
+| ff 57 38 58 |.W8X |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #39 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| ea 17 35 2b f9 58 60 e8 da 99 8e 50 0e 34 8b c3 |..5+.X`....P.4..|
+| 90 f3 f0 c0 2e 43 29 42 93 d9 15 c6 f8 76 b1 0c |.....C)B.....v..|
+| 83 62 f3 a3 |.b.. |
+Plaintext[36]:
+| 14 00 00 0c 07 14 b5 ea 5b fc 04 34 bf aa bc 8d |........[..4....|
+| 1a 7d 3a 11 37 05 ae b4 58 98 3d 8a 76 84 70 42 |.}:.7...X.=.v.pB|
+| 51 3a a0 9e |Q:.. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1a 7d 3a 11 37 05 ae b4 58 98 3d 8a 76 84 70 42 |.}:.7...X.=.v.pB|
+| 51 3a a0 9e |Q:.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #40 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 00 a0 49 01 52 e5 5b d2 dd 5d 2e 50 04 21 e0 60 |..I.R.[..].P.!.`|
+| e8 36 52 91 2d c6 c0 8a fd 03 fb cf 58 39 f6 e4 |.6R.-.......X9..|
+| 80 91 d7 8a cc 56 0b 3e 1f bd 05 2e 27 a7 23 a2 |.....V.>....'.#.|
+| c6 f5 1b 68 45 d4 49 05 e2 8a 6b 21 e5 9a e2 b5 |...hE.I...k!....|
+| 92 49 f4 9f 1a 6a b5 26 41 85 2d 81 0f 56 a7 fd |.I...j.&A.-..V..|
+| 50 |P |
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a 5d b3 6a |n.nl:4436....].j|
+| f8 c1 ad 06 d8 26 c8 30 4d b4 2e cb ea 0d d1 b3 |.....&.0M.......|
+| 41 |A |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d b3 6a f8 c1 ad 06 d8 26 c8 30 4d b4 2e cb ea |].j.....&.0M....|
+| 0d d1 b3 41 |...A |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 52730 found (nil)
+association_find: TCP port 4436 found 0x34146c0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a |n.nl:4436.... |
+dissect_ssl3_record found association 0x34146c0
+
+dissect_ssl enter frame #41 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| 5d 7a 6a f6 d1 64 34 31 94 c4 2a fd 4c 12 30 51 |]zj..d41..*.L.0Q|
+| a0 3b 2c fa 77 25 e0 b1 d2 7a 1d e8 69 81 0a bf |.;,.w%...z..i...|
+| 04 80 32 86 9b a6 81 a4 58 32 39 99 5e 0f 6a a9 |..2.....X29.^.j.|
+| 8c ce 7f 01 34 72 09 82 98 69 ec f7 b5 e5 4a 36 |....4r...i....J6|
+| 14 f2 db d3 08 22 2c 76 89 cb ae 2b 42 b3 c7 41 |.....",v...+B..A|
+| 07 5c 64 5a b4 3c bd df 17 ad 84 cd 4f 31 c9 33 |.\dZ.<......O1.3|
+| 13 6f 26 3a c0 7d e5 12 91 12 77 f6 1c bf 87 be |.o&:.}....w.....|
+| 16 6e 4c bb 27 83 63 b9 cb aa b6 99 2e c1 db d6 |.nL.'.c.........|
+| 96 3d dc cf f1 53 6c b8 c5 36 f3 4d b7 99 47 e4 |.=...Sl..6.M..G.|
+| 4e 6a bb 3f 90 18 d4 de 2f 83 b5 1d 72 ac bb 1c |Nj.?..../...r...|
+| 26 7c 0f 94 53 39 45 d4 dc 72 67 24 2f 1c 43 17 |&|..S9E..rg$/.C.|
+| f5 f8 08 49 7f 6c 6d de 7f ce 67 e7 8d c6 01 fc |...I.lm...g.....|
+| 0c a7 7b df 11 20 70 d3 2e 90 ed c6 b4 12 43 5b |..{.. p.......C[|
+| 74 8d 9b 56 83 52 c0 b8 22 75 ab a4 12 89 d0 09 |t..V.R.."u......|
+| a3 5c fc 86 88 31 d6 86 eb 1c 96 36 2d 40 cc ee |.\...1.....6-@..|
+| 55 f8 4c 46 44 74 7a 6f a3 68 e2 00 2f 7f e8 3e |U.LFDtzo.h../..>|
+| 9f 67 8a f6 14 b0 f2 08 c7 c5 10 b0 ab af 91 6b |.g.............k|
+| c5 0a 0a 66 26 32 aa 1a bc 02 34 ee e4 6b 19 3c |...f&2....4..k.<|
+| 84 b8 d7 7b 8a f7 e2 ec 89 b3 bc 95 95 48 ce 25 |...{.........H.%|
+| 8d bb 43 11 9c e2 1b b7 fd 2d 13 b5 23 d9 e2 c4 |..C......-..#...|
+| e3 0f 78 13 98 07 e3 00 41 5b 35 3e 77 24 6b b2 |..x.....A[5>w$k.|
+| 72 09 68 37 db dc b4 6e c0 3d a3 72 a6 38 3d fc |r.h7...n.=.r.8=.|
+| 7e 4f 8c e1 9b 35 96 27 17 95 c3 25 e2 64 05 b2 |~O...5.'...%.d..|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e c8 44 c0 33 |nl'</script>.D.3|
+| 48 df 21 8c ac 16 a0 b8 88 17 9e 10 6c 8e 97 a4 |H.!.........l...|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c8 44 c0 33 48 df 21 8c ac 16 a0 b8 88 17 9e 10 |.D.3H.!.........|
+| 6c 8e 97 a4 |l... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4436 found 0x34146c0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x34146c0
+
+dissect_ssl enter frame #42 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 76 a6 49 15 74 b7 6c 75 86 25 b6 68 c9 28 a8 08 |v.I.t.lu.%.h.(..|
+| 7c 93 8e 21 6e 71 ||..!nq |
+Plaintext[22]:
+| 01 00 e1 71 41 33 bd 7d 3a e6 f8 91 96 75 9c 6c |...qA3.}:....u.l|
+| fe a7 79 43 a9 29 |..yC.) |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 71 41 33 bd 7d 3a e6 f8 91 96 75 9c 6c fe a7 |.qA3.}:....u.l..|
+| 79 43 a9 29 |yC.) |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #44 (first time)
+ conversation = 0x7fb97956b728, ssl_session = 0x7fb94d3cb310
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 85 5f c9 88 56 9b f5 56 9e 2f 7d 1d ba a9 dd 62 |._..V..V./}....b|
+| 2d 1d f7 3c 38 20 |-..<8 |
+Plaintext[22]:
+| 01 00 e1 7f c8 d2 69 cf 40 26 15 f8 cf f2 d3 54 |......i.@&.....T|
+| c3 1d 4b 22 05 da |..K".. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 7f c8 d2 69 cf 40 26 15 f8 cf f2 d3 54 c3 1d |....i.@&.....T..|
+| 4b 22 05 da |K".. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #49 (first time)
+ssl_session_init: initializing ptr 0x7fb94d3cdcd0 size 688
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34339 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4479
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #51 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC002 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 73 72 51 78 33 5f 5d ff 05 25 c6 48 0d c4 a0 ef |srQx3_]..%.H....|
+| 91 70 69 e4 18 dd 54 16 7a 64 c2 67 d9 3c 5b 64 |.pi...T.zd.g.<[d|
+| 08 83 a2 c8 0b 60 d4 50 1f 40 e4 42 86 c1 bf 98 |.....`.P.@.B....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e d0 98 28 f0 59 7a c3 02 34 4b 0c 01 62 2e a0 |n..(.Yz..4K..b..|
+| 95 76 0e c4 17 a1 04 18 28 95 f9 d8 f4 52 34 c6 |.v......(....R4.|
+| 6e 96 87 63 98 ad 6e cf f1 b3 ff b7 58 71 9b b5 |n..c..n.....Xq..|
+| 12 58 ea ea 31 bb 97 a4 be 4e 7e ca 41 |.X..1....N~.A |
+hash out[72]:
+| 4f 1a a6 e9 06 7c 6c 9a 74 e0 05 14 d6 ef d0 a6 |O....|l.t.......|
+| aa 40 26 bf 47 c2 72 62 3b 95 e4 37 ee 96 29 ea |.@&.G.rb;..7..).|
+| 10 6c fd 76 43 3d 8d 05 21 cc 4a fd 77 80 7a d2 |.l.vC=..!.J.w.z.|
+| cc 5a aa 90 9d 82 87 37 74 41 8f b8 14 82 38 c1 |.Z.....7tA....8.|
+| 33 27 cf 58 57 82 01 99 |3'.XW... |
+PRF out[72]:
+| 4f 1a a6 e9 06 7c 6c 9a 74 e0 05 14 d6 ef d0 a6 |O....|l.t.......|
+| aa 40 26 bf 47 c2 72 62 3b 95 e4 37 ee 96 29 ea |.@&.G.rb;..7..).|
+| 10 6c fd 76 43 3d 8d 05 21 cc 4a fd 77 80 7a d2 |.l.vC=..!.J.w.z.|
+| cc 5a aa 90 9d 82 87 37 74 41 8f b8 14 82 38 c1 |.Z.....7tA....8.|
+| 33 27 cf 58 57 82 01 99 |3'.XW... |
+key expansion[72]:
+| 4f 1a a6 e9 06 7c 6c 9a 74 e0 05 14 d6 ef d0 a6 |O....|l.t.......|
+| aa 40 26 bf 47 c2 72 62 3b 95 e4 37 ee 96 29 ea |.@&.G.rb;..7..).|
+| 10 6c fd 76 43 3d 8d 05 21 cc 4a fd 77 80 7a d2 |.l.vC=..!.J.w.z.|
+| cc 5a aa 90 9d 82 87 37 74 41 8f b8 14 82 38 c1 |.Z.....7tA....8.|
+| 33 27 cf 58 57 82 01 99 |3'.XW... |
+Client MAC key[20]:
+| 4f 1a a6 e9 06 7c 6c 9a 74 e0 05 14 d6 ef d0 a6 |O....|l.t.......|
+| aa 40 26 bf |.@&. |
+Server MAC key[20]:
+| 47 c2 72 62 3b 95 e4 37 ee 96 29 ea 10 6c fd 76 |G.rb;..7..)..l.v|
+| 43 3d 8d 05 |C=.. |
+Client Write key[16]:
+| 21 cc 4a fd 77 80 7a d2 cc 5a aa 90 9d 82 87 37 |!.J.w.z..Z.....7|
+Server Write key[16]:
+| 74 41 8f b8 14 82 38 c1 33 27 cf 58 57 82 01 99 |tA....8.3'.XW...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #53 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66e96876398ad6ecff1b3ffb758719bb51258eaea31...
+looking for RSA pre-master610430861bf4e0270fda641c54975775efa90f1ac7a0b59c...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8ff18262ab227e698 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed7431ad374c1699d8f911d241070e4afd8fba7c697ae5c8fa12ec184 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66eee73fea21eb7ef62cf264d205d6fcd7841f949adf80bc6c703e4c264 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e035f0cddbb9b4d52bec23d49e58691e0cce1bde6b4ded568c8c82a76 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed09828f0597ac302344b0c01622ea095760ec417a104182895f9d8f4 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e96876398ad6ecff1b3ffb758719bb51258eaea31bb97a4be4e7eca41 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 26 f0 86 78 b7 11 5a 89 88 62 d8 c3 ee 82 7e 1b |&..x..Z..b....~.|
+| 8a 13 4c 43 f2 18 b1 e5 4e d0 27 69 2f 89 1a 40 |..LC....N.'i/..@|
+| 5e 53 2d f1 f5 3b df 6e 44 3d 5a d2 33 cd e0 63 |^S-..;.nD=Z.3..c|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e d0 98 28 f0 59 7a c3 02 34 4b 0c 01 62 2e a0 |n..(.Yz..4K..b..|
+| 95 76 0e c4 17 a1 04 18 28 95 f9 d8 f4 52 34 c6 |.v......(....R4.|
+| 6e 96 87 63 98 ad 6e cf f1 b3 ff b7 58 71 9b b5 |n..c..n.....Xq..|
+| 12 58 ea ea 31 bb 97 a4 be 4e 7e ca 41 |.X..1....N~.A |
+hash out[72]:
+| 1c 12 55 ac 08 f8 a0 e6 b3 13 24 c2 fa e3 32 08 |..U.......$...2.|
+| ba 2d 46 7c 2c f8 82 a5 4a 56 69 51 85 cd 42 c4 |.-F|,...JViQ..B.|
+| 45 33 f2 5f ee 4c d8 95 32 5c aa 6c b5 70 c5 47 |E3._.L..2\.l.p.G|
+| 80 ea f3 5b 4f 17 53 24 55 e8 95 1e e2 7c 32 6b |...[O.S$U....|2k|
+| 59 62 5c 79 64 7f b9 11 |Yb\yd... |
+PRF out[72]:
+| 1c 12 55 ac 08 f8 a0 e6 b3 13 24 c2 fa e3 32 08 |..U.......$...2.|
+| ba 2d 46 7c 2c f8 82 a5 4a 56 69 51 85 cd 42 c4 |.-F|,...JViQ..B.|
+| 45 33 f2 5f ee 4c d8 95 32 5c aa 6c b5 70 c5 47 |E3._.L..2\.l.p.G|
+| 80 ea f3 5b 4f 17 53 24 55 e8 95 1e e2 7c 32 6b |...[O.S$U....|2k|
+| 59 62 5c 79 64 7f b9 11 |Yb\yd... |
+key expansion[72]:
+| 1c 12 55 ac 08 f8 a0 e6 b3 13 24 c2 fa e3 32 08 |..U.......$...2.|
+| ba 2d 46 7c 2c f8 82 a5 4a 56 69 51 85 cd 42 c4 |.-F|,...JViQ..B.|
+| 45 33 f2 5f ee 4c d8 95 32 5c aa 6c b5 70 c5 47 |E3._.L..2\.l.p.G|
+| 80 ea f3 5b 4f 17 53 24 55 e8 95 1e e2 7c 32 6b |...[O.S$U....|2k|
+| 59 62 5c 79 64 7f b9 11 |Yb\yd... |
+Client MAC key[20]:
+| 1c 12 55 ac 08 f8 a0 e6 b3 13 24 c2 fa e3 32 08 |..U.......$...2.|
+| ba 2d 46 7c |.-F| |
+Server MAC key[20]:
+| 2c f8 82 a5 4a 56 69 51 85 cd 42 c4 45 33 f2 5f |,...JViQ..B.E3._|
+| ee 4c d8 95 |.L.. |
+Client Write key[16]:
+| 32 5c aa 6c b5 70 c5 47 80 ea f3 5b 4f 17 53 24 |2\.l.p.G...[O.S$|
+Server Write key[16]:
+| 55 e8 95 1e e2 7c 32 6b 59 62 5c 79 64 7f b9 11 |U....|2kYb\yd...|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 35 72 03 00 00 00 00 |@5r..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 26 f0 86 78 b7 11 5a 89 88 62 d8 c3 ee 82 7e 1b |&..x..Z..b....~.|
+| 8a 13 4c 43 f2 18 b1 e5 4e d0 27 69 2f 89 1a 40 |..LC....N.'i/..@|
+| 5e 53 2d f1 f5 3b df 6e 44 3d 5a d2 33 cd e0 63 |^S-..;.nD=Z.3..c|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| a2 fd ba 64 ac e8 7b c0 7a 93 47 74 de 21 a2 93 |...d..{.z.Gt.!..|
+| c3 cf db 1d d7 cd 9e 4f f8 ca e7 a1 24 53 fc c7 |.......O....$S..|
+| d1 1f bd e0 |.... |
+Plaintext[36]:
+| 14 00 00 0c 18 e1 7d 86 d2 d5 60 d4 2f c4 75 f0 |......}...`./.u.|
+| 48 8c a4 13 53 8b 44 61 74 28 05 8c ff f4 a2 b1 |H...S.Dat(......|
+| d6 d2 0f a3 |.... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 48 8c a4 13 53 8b 44 61 74 28 05 8c ff f4 a2 b1 |H...S.Dat(......|
+| d6 d2 0f a3 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #54 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 54 39 01 fe 8c ea a6 9e 0f d6 57 cd d0 e1 e8 e3 |T9........W.....|
+| 5d c4 a1 f3 88 41 5f 84 91 c0 cc 6b 6e 82 7d 92 |]....A_....kn.}.|
+| 38 24 27 2b |8$'+ |
+Plaintext[36]:
+| 14 00 00 0c 41 cd 0b 8c 33 75 d4 e1 2b 4c 86 b3 |....A...3u..+L..|
+| 05 8b 4f f4 80 aa 34 b0 d2 be 77 15 a9 e4 3f d6 |..O...4...w...?.|
+| 91 ab d5 44 |...D |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 05 8b 4f f4 80 aa 34 b0 d2 be 77 15 a9 e4 3f d6 |..O...4...w...?.|
+| 91 ab d5 44 |...D |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #55 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 97
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 92, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 92
+Ciphertext[92]:
+| a3 d9 60 9b a2 2e 07 ce b1 38 1c e7 50 cc eb f0 |..`......8..P...|
+| 69 a7 e0 0c 31 e4 2e cc e7 39 d3 fd c4 6a aa ce |i...1....9...j..|
+| a1 4d 56 44 79 6f bb 92 6e b6 8b d6 c7 b6 87 ae |.MVDyo..n.......|
+| 3f 52 6c b8 dd 10 17 7d 09 df 8c f3 e6 ee 4a 1a |?Rl....}......J.|
+| ee d0 95 c1 13 f4 58 9a 05 82 57 34 8e c6 b1 d5 |......X...W4....|
+| bc 10 ea 01 34 b4 79 6f ea 52 d4 4a |....4.yo.R.J |
+Plaintext[92]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a 71 47 69 bd 1c 52 6e a6 |4479....qGi..Rn.|
+| 8b 71 98 6f d6 71 57 e7 69 ad 81 1d |.q.o.qW.i... |
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 71 47 69 bd 1c 52 6e a6 8b 71 98 6f d6 71 57 e7 |qGi..Rn..q.o.qW.|
+| 69 ad 81 1d |i... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 34339 found (nil)
+association_find: TCP port 4479 found 0x34178c0
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a |4479.... |
+dissect_ssl3_record found association 0x34178c0
+
+dissect_ssl enter frame #56 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 375
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 370, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 370
+Ciphertext[370]:
+| fd 1a bb 96 0c 4d b9 51 b8 81 45 f8 ad 70 c0 52 |.....M.Q..E..p.R|
+| 1b 97 df 68 bb d2 fd a7 7e b5 67 b4 be cb 31 da |...h....~.g...1.|
+| cf 2e 87 dd a2 ca 0a 82 1a 34 ee f6 27 95 86 1d |.........4..'...|
+| f4 a9 6a 38 c3 c3 1e 70 ba 44 4e 79 dc 5e 4e 50 |..j8...p.DNy.^NP|
+| 12 f7 c9 93 e6 94 71 87 43 c7 cb ae 76 f6 a4 95 |......q.C...v...|
+| 7e e1 c1 83 66 41 2b 20 2e b0 32 30 01 89 b3 d4 |~...fA+ ..20....|
+| 82 ea b2 f3 d8 ac d7 44 8f c3 f2 01 fc 83 82 f5 |.......D........|
+| 4a a1 fc 39 1d 4b da fd e0 dc 66 0c 1c 8d 0f 6e |J..9.K....f....n|
+| c4 c8 ed b1 f0 64 c2 49 eb 19 18 2f a1 56 fb b9 |.....d.I.../.V..|
+| 89 9c de ca 57 ed ee 68 ef 30 07 ba 8a ee 75 1a |....W..h.0....u.|
+| 96 9a af 36 9b e7 88 b1 3e 2e 47 7c 03 2d e9 67 |...6....>.G|.-.g|
+| 91 95 ce ac 56 ab c1 81 47 ec e4 97 30 df 1c 94 |....V...G...0...|
+| 1b 82 84 5d df 34 bc a1 8f 5d 5d 14 15 ac f1 4b |...].4...]]....K|
+| 03 a9 5f 88 75 e5 e1 d6 2d 30 b7 78 e9 7d 6b db |.._.u...-0.x.}k.|
+| ce 9b 10 08 2d 3b fb fd c0 06 b5 68 fb b3 2c 0c |....-;.....h..,.|
+| 5c 13 21 35 5e b9 a5 b6 b1 6e f4 21 29 ad f1 9c |\.!5^....n.!)...|
+| 88 f2 b2 65 5c 17 fb 48 03 8a 68 37 8f fa aa 15 |...e\..H..h7....|
+| c5 4e cf f8 f5 b3 fc e0 82 1c 09 de 49 b3 c1 9b |.N..........I...|
+| fc 29 31 bf 64 34 e4 12 09 0c c4 b7 3f 59 37 8c |.)1.d4......?Y7.|
+| 4e 37 8c 9e 9a 86 b1 c2 66 65 fd 71 72 0d fd 5e |N7......fe.qr..^|
+| 77 f6 b1 e3 6f a9 14 ee f2 c1 22 d6 ce 91 c7 c5 |w...o.....".....|
+| 25 4e 14 d4 89 8f a7 a7 69 b7 f0 21 96 bd 7e 1a |%N......i..!..~.|
+| 2e e8 71 c0 87 ac 92 80 0e 60 8b 3a c1 08 06 38 |..q......`.:...8|
+| a3 03 |.. |
+Plaintext[370]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e b3 da |n.nl'</script>..|
+| 0f 32 78 9b 48 e5 17 5f 71 3e 4e b8 fc 93 5f 76 |.2x.H.._q>N..._v|
+| 68 66 |hf |
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 da 0f 32 78 9b 48 e5 17 5f 71 3e 4e b8 fc 93 |...2x.H.._q>N...|
+| 5f 76 68 66 |_vhf |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4479 found 0x34178c0
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x34178c0
+
+dissect_ssl enter frame #57 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 7b ee 1a 68 c4 f6 a0 50 ef ee ae 08 80 09 f1 3d |{..h...P.......=|
+| e0 8a 3d db 1e c9 |..=... |
+Plaintext[22]:
+| 01 00 61 42 44 21 e6 de a3 49 66 d6 70 0f 90 35 |..aBD!...If.p..5|
+| ba 4c e3 34 3a f4 |.L.4:. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 61 42 44 21 e6 de a3 49 66 d6 70 0f 90 35 ba 4c |aBD!...If.p..5.L|
+| e3 34 3a f4 |.4:. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #59 (first time)
+ conversation = 0x7fb97956ba78, ssl_session = 0x7fb94d3cdcd0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| bb fa eb a9 7a e0 bb b7 37 db 0b c8 6e c7 6b ce |....z...7...n.k.|
+| 1c 6f 22 6d 4f 0c |.o"mO. |
+Plaintext[22]:
+| 01 00 60 48 98 ac be 21 1b d0 f2 89 c5 22 d1 1f |..`H...!....."..|
+| 11 f1 63 2d a4 e4 |..c-.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 60 48 98 ac be 21 1b d0 f2 89 c5 22 d1 1f 11 f1 |`H...!....."....|
+| 63 2d a4 e4 |c-.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #64 (first time)
+ssl_session_init: initializing ptr 0x7fb94d3d0600 size 688
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 42963 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4483
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #66 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 749
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 26 f0 86 78 b7 11 5a 89 88 62 d8 c3 ee 82 7e 1b |&..x..Z..b....~.|
+| 8a 13 4c 43 f2 18 b1 e5 4e d0 27 69 2f 89 1a 40 |..LC....N.'i/..@|
+| 5e 53 2d f1 f5 3b df 6e 44 3d 5a d2 33 cd e0 63 |^S-..;.nD=Z.3..c|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e 23 3f c9 5e ee 0a 92 ea 66 7a b4 11 bf cc 02 |n#?.^....fz.....|
+| 61 62 36 63 19 ff 18 f4 bb d8 be 92 cb 52 34 c6 |ab6c.........R4.|
+| 6e fe 0d bb ea 44 df 8c 5a 20 59 7b f2 15 e5 80 |n....D..Z Y{....|
+| 2c 26 d4 b5 24 cf 19 67 05 5a 74 2e c6 |,&..$..g.Zt.. |
+hash out[72]:
+| f9 17 f3 4b 5c 20 45 3f 9b a8 0e a1 ee 8e f7 3a |...K\ E?.......:|
+| c8 50 4e 2d af 3a 70 30 dd 17 8e d0 cd 4c 6c 58 |.PN-.:p0.....LlX|
+| a7 ea 2a d1 8c f9 13 75 f2 20 d9 3b 6a c2 8a db |..*....u. .;j...|
+| c4 53 4b 09 69 80 ec 5c 64 bd 1d be 47 ef 4a 91 |.SK.i..\d...G.J.|
+| f8 59 2a f7 27 04 e5 bb |.Y*.'... |
+PRF out[72]:
+| f9 17 f3 4b 5c 20 45 3f 9b a8 0e a1 ee 8e f7 3a |...K\ E?.......:|
+| c8 50 4e 2d af 3a 70 30 dd 17 8e d0 cd 4c 6c 58 |.PN-.:p0.....LlX|
+| a7 ea 2a d1 8c f9 13 75 f2 20 d9 3b 6a c2 8a db |..*....u. .;j...|
+| c4 53 4b 09 69 80 ec 5c 64 bd 1d be 47 ef 4a 91 |.SK.i..\d...G.J.|
+| f8 59 2a f7 27 04 e5 bb |.Y*.'... |
+key expansion[72]:
+| f9 17 f3 4b 5c 20 45 3f 9b a8 0e a1 ee 8e f7 3a |...K\ E?.......:|
+| c8 50 4e 2d af 3a 70 30 dd 17 8e d0 cd 4c 6c 58 |.PN-.:p0.....LlX|
+| a7 ea 2a d1 8c f9 13 75 f2 20 d9 3b 6a c2 8a db |..*....u. .;j...|
+| c4 53 4b 09 69 80 ec 5c 64 bd 1d be 47 ef 4a 91 |.SK.i..\d...G.J.|
+| f8 59 2a f7 27 04 e5 bb |.Y*.'... |
+Client MAC key[20]:
+| f9 17 f3 4b 5c 20 45 3f 9b a8 0e a1 ee 8e f7 3a |...K\ E?.......:|
+| c8 50 4e 2d |.PN- |
+Server MAC key[20]:
+| af 3a 70 30 dd 17 8e d0 cd 4c 6c 58 a7 ea 2a d1 |.:p0.....LlX..*.|
+| 8c f9 13 75 |...u |
+Client Write key[16]:
+| f2 20 d9 3b 6a c2 8a db c4 53 4b 09 69 80 ec 5c |. .;j....SK.i..\|
+Server Write key[16]:
+| 64 bd 1d be 47 ef 4a 91 f8 59 2a f7 27 04 e5 bb |d...G.J..Y*.'...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 678
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 193
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 179, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 175 bytes, remaining 740
+ record: offset = 740, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 745 length 0 bytes, remaining 749
+
+dissect_ssl enter frame #68 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66efe0dbbea44df8c5a20597bf215e5802c26d4b524...
+looking for RSA pre-master4104286ee16f4b6aecb0bb4ee2040e2c93650b01f256d039...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8ff18262ab227e698 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed7431ad374c1699d8f911d241070e4afd8fba7c697ae5c8fa12ec184 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66eee73fea21eb7ef62cf264d205d6fcd7841f949adf80bc6c703e4c264 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e035f0cddbb9b4d52bec23d49e58691e0cce1bde6b4ded568c8c82a76 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed09828f0597ac302344b0c01622ea095760ec417a104182895f9d8f4 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e96876398ad6ecff1b3ffb758719bb51258eaea31bb97a4be4e7eca41 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e233fc95eee0a92ea667ab411bfcc026162366319ff18f4bbd8be92cb E7398CDF3750E10FE7E1D5F7BAF3646AF4D2BC096646FEDBB7E11BC35338E1524F6BD2049378990969F6077CEA503202
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66efe0dbbea44df8c5a20597bf215e5802c26d4b524cf1967055a742ec6 E7398CDF3750E10FE7E1D5F7BAF3646AF4D2BC096646FEDBB7E11BC35338E1524F6BD2049378990969F6077CEA503202
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e7 39 8c df 37 50 e1 0f e7 e1 d5 f7 ba f3 64 6a |.9..7P........dj|
+| f4 d2 bc 09 66 46 fe db b7 e1 1b c3 53 38 e1 52 |....fF......S8.R|
+| 4f 6b d2 04 93 78 99 09 69 f6 07 7c ea 50 32 02 |Ok...x..i..|.P2.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6e 23 3f c9 5e ee 0a 92 ea 66 7a b4 11 bf cc 02 |n#?.^....fz.....|
+| 61 62 36 63 19 ff 18 f4 bb d8 be 92 cb 52 34 c6 |ab6c.........R4.|
+| 6e fe 0d bb ea 44 df 8c 5a 20 59 7b f2 15 e5 80 |n....D..Z Y{....|
+| 2c 26 d4 b5 24 cf 19 67 05 5a 74 2e c6 |,&..$..g.Zt.. |
+hash out[72]:
+| d0 31 1c f0 05 d2 4b 85 ad 2e 83 d9 c9 03 9b ee |.1....K.........|
+| 81 78 0d 31 8f 4e bb c9 15 d5 7d c6 3b e6 e6 7c |.x.1.N....}.;..||
+| 06 20 1b 03 11 90 26 1c 94 f5 4b ba ff 1e d4 18 |. ....&...K.....|
+| c3 4f d5 83 1e 60 f4 9b 84 cc cd 62 b8 b2 7b 6d |.O...`.....b..{m|
+| 01 3d 5d a2 a1 e7 01 f7 |.=]..... |
+PRF out[72]:
+| d0 31 1c f0 05 d2 4b 85 ad 2e 83 d9 c9 03 9b ee |.1....K.........|
+| 81 78 0d 31 8f 4e bb c9 15 d5 7d c6 3b e6 e6 7c |.x.1.N....}.;..||
+| 06 20 1b 03 11 90 26 1c 94 f5 4b ba ff 1e d4 18 |. ....&...K.....|
+| c3 4f d5 83 1e 60 f4 9b 84 cc cd 62 b8 b2 7b 6d |.O...`.....b..{m|
+| 01 3d 5d a2 a1 e7 01 f7 |.=]..... |
+key expansion[72]:
+| d0 31 1c f0 05 d2 4b 85 ad 2e 83 d9 c9 03 9b ee |.1....K.........|
+| 81 78 0d 31 8f 4e bb c9 15 d5 7d c6 3b e6 e6 7c |.x.1.N....}.;..||
+| 06 20 1b 03 11 90 26 1c 94 f5 4b ba ff 1e d4 18 |. ....&...K.....|
+| c3 4f d5 83 1e 60 f4 9b 84 cc cd 62 b8 b2 7b 6d |.O...`.....b..{m|
+| 01 3d 5d a2 a1 e7 01 f7 |.=]..... |
+Client MAC key[20]:
+| d0 31 1c f0 05 d2 4b 85 ad 2e 83 d9 c9 03 9b ee |.1....K.........|
+| 81 78 0d 31 |.x.1 |
+Server MAC key[20]:
+| 8f 4e bb c9 15 d5 7d c6 3b e6 e6 7c 06 20 1b 03 |.N....}.;..|. ..|
+| 11 90 26 1c |..&. |
+Client Write key[16]:
+| 94 f5 4b ba ff 1e d4 18 c3 4f d5 83 1e 60 f4 9b |..K......O...`..|
+Server Write key[16]:
+| 84 cc cd 62 b8 b2 7b 6d 01 3d 5d a2 a1 e7 01 f7 |...b..{m.=].....|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 33 72 03 00 00 00 00 | 3r..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| e7 39 8c df 37 50 e1 0f e7 e1 d5 f7 ba f3 64 6a |.9..7P........dj|
+| f4 d2 bc 09 66 46 fe db b7 e1 1b c3 53 38 e1 52 |....fF......S8.R|
+| 4f 6b d2 04 93 78 99 09 69 f6 07 7c ea 50 32 02 |Ok...x..i..|.P2.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 28 9b be 39 c6 f9 e2 fd e4 9c 80 e1 59 dd f8 d1 |(..9........Y...|
+| 8f 23 bd b3 d1 de e7 4c 71 ca 5e 5b 93 b3 1c ac |.#.....Lq.^[....|
+| a2 48 52 78 |.HRx |
+Plaintext[36]:
+| 14 00 00 0c c9 21 36 4d 4e fb 81 d2 24 ba f5 89 |.....!6MN...$...|
+| 51 b4 28 e3 8b 14 c0 56 2f e9 5c fd b4 d4 d3 ef |Q.(....V/.\.....|
+| 05 f0 d2 15 |.... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 51 b4 28 e3 8b 14 c0 56 2f e9 5c fd b4 d4 d3 ef |Q.(....V/.\.....|
+| 05 f0 d2 15 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #69 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| d4 b2 fc 4e 59 af c3 22 aa 44 f2 14 e9 26 1b 2f |...NY..".D...&./|
+| 9a 30 c2 df d2 0d 39 3c 06 df 1b 29 82 f5 5e 66 |.0....9<...)..^f|
+| 17 57 1c a4 |.W.. |
+Plaintext[36]:
+| 14 00 00 0c 83 32 af 4a 2f 42 9e 42 4c 73 3f 18 |.....2.J/B.BLs?.|
+| 06 00 31 d2 bf 9c 97 e4 81 33 39 00 7a 9e 13 01 |..1......39.z...|
+| 49 15 0d 02 |I... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 06 00 31 d2 bf 9c 97 e4 81 33 39 00 7a 9e 13 01 |..1......39.z...|
+| 49 15 0d 02 |I... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #70 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 98
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 93, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 93
+Ciphertext[93]:
+| b5 b1 bf c0 92 39 5b 70 2b c9 60 79 4b e0 57 c8 |.....9[p+.`yK.W.|
+| f4 ba 6a 24 44 a5 43 58 bf ce 42 63 78 1a be ab |..j$D.CX..Bcx...|
+| c4 5a 71 f2 4f 71 63 8c e6 79 fa f1 03 71 f6 a3 |.Zq.Oqc..y...q..|
+| d2 57 c8 2f 3b 26 be c1 3a ef bb 98 ef 18 4d ae |.W./;&..:.....M.|
+| b2 e8 6a 4a 3d cc 8a 99 a8 b8 dc d4 a4 3a e9 18 |..jJ=........:..|
+| e2 25 7e 46 d4 f2 1e 2c 91 bf 00 99 78 |.%~F...,....x |
+Plaintext[93]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a 18 d5 ec e2 1c 3d 66 |:4483.........=f|
+| 37 80 df 78 d7 62 51 48 aa f9 8b 20 3c |7..x.bQH... < |
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 18 d5 ec e2 1c 3d 66 37 80 df 78 d7 62 51 48 aa |.....=f7..x.bQH.|
+| f9 8b 20 3c |.. < |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73
+association_find: TCP port 42963 found (nil)
+association_find: TCP port 4483 found 0x3417b00
+dissect_ssl3_record decrypted len 73
+decrypted app data fragment[73]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a |:4483.... |
+dissect_ssl3_record found association 0x3417b00
+
+dissect_ssl enter frame #71 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 374
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 369, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 369
+Ciphertext[369]:
+| 82 38 03 c0 15 41 83 4d 0f 2e d4 7c 7c f9 1b 34 |.8...A.M...||..4|
+| 90 bf ff 3b c7 35 f0 01 5a 3d 53 ae b1 23 ea 5b |...;.5..Z=S..#.[|
+| cd af 7c ac 8f 35 dc f7 e4 18 5d c1 25 80 15 ae |..|..5....].%...|
+| 53 d3 95 0e d3 23 d6 14 5c f5 a6 a1 7d 8e 6e b8 |S....#..\...}.n.|
+| 41 36 e7 da 93 ba 76 f4 d3 2b dd 87 6c ce 5c 8b |A6....v..+..l.\.|
+| 78 ff e9 32 ed ec c4 91 e9 e2 c7 85 56 c9 ce f8 |x..2........V...|
+| 5b 13 7f de 80 a0 1b b1 4b 1b 36 f6 81 aa 19 2c |[.......K.6....,|
+| 80 c1 e5 9b 66 4b 23 7f ea a5 3b aa 41 9d 73 90 |....fK#...;.A.s.|
+| 8b 54 9e 17 de e3 31 69 69 44 00 31 b0 27 02 2e |.T....1iiD.1.'..|
+| c5 76 a8 65 90 e5 64 6a bc f8 1f ce 41 56 16 0b |.v.e..dj....AV..|
+| 65 34 8e e2 05 4c 01 5c ba ae eb ea dd 25 e0 75 |e4...L.\.....%.u|
+| 99 53 e7 ac d0 34 68 b5 15 1a f4 8c 9e 79 36 b3 |.S...4h......y6.|
+| 81 e6 df ef 22 bc 4d 35 ae ae 35 dc 46 cf 8d 1c |....".M5..5.F...|
+| a7 e3 c1 ff 40 11 4d aa 99 a5 11 b6 e5 ac 1d 3e |....@.M........>|
+| 2b 2e f3 62 36 b8 bb 83 61 f2 b7 77 0b ab 7f 6a |+..b6...a..w...j|
+| c2 e5 6f dd b3 23 29 2d 12 2f 83 6d ec 9e a6 e9 |..o..#)-./.m....|
+| 8e c2 e1 19 0b 9d 35 60 12 1a 83 87 ca 55 b2 1c |......5`.....U..|
+| 7e c4 95 ed e7 6a e7 f6 70 95 d7 b5 16 52 97 d3 |~....j..p....R..|
+| cc 6c 8a 31 de 67 eb 14 30 a5 fe fe 14 b0 26 67 |.l.1.g..0.....&g|
+| 2c 61 05 d3 9b d4 77 f0 98 55 15 7f b9 bf 27 61 |,a....w..U....'a|
+| 84 51 f7 69 c3 93 77 9d 0f 1f f3 c8 e2 c3 c4 f6 |.Q.i..w.........|
+| 72 07 be 3d 09 bd 8a 72 8e a2 bc ec 55 40 6c 19 |r..=...r....U@l.|
+| a4 6a f3 39 a8 0f 36 1a 87 6f 75 33 60 f3 b4 61 |.j.9..6..ou3`..a|
+| a5 |. |
+Plaintext[369]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 7e 0b 56 |.nl'</script>~.V|
+| 79 9d 68 5d 32 50 9a fc 53 e5 69 fa a0 5e 4c f6 |y.h]2P..S.i..^L.|
+| 67 |g |
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7e 0b 56 79 9d 68 5d 32 50 9a fc 53 e5 69 fa a0 |~.Vy.h]2P..S.i..|
+| 5e 4c f6 67 |^L.g |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349
+association_find: TCP port 4483 found 0x3417b00
+dissect_ssl3_record decrypted len 349
+decrypted app data fragment[349]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:22 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |.nl'</script> |
+dissect_ssl3_record found association 0x3417b00
+
+dissect_ssl enter frame #72 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| a1 6f 18 3e ce 3a c6 ae d9 6f 80 2f 9f cd 61 fa |.o.>.:...o./..a.|
+| 50 78 2b 3c 85 c1 |Px+<.. |
+Plaintext[22]:
+| 01 00 72 54 76 f0 64 d9 f5 7b 8f bd 40 f5 a9 2e |..rTv.d..{..@...|
+| ad d3 21 d4 f9 14 |..!... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 72 54 76 f0 64 d9 f5 7b 8f bd 40 f5 a9 2e ad d3 |rTv.d..{..@.....|
+| 21 d4 f9 14 |!... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #74 (first time)
+ conversation = 0x7fb97956bdd0, ssl_session = 0x7fb94d3d0600
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| e5 af 1c 1f e0 ec aa cd 42 02 dd fc f9 36 78 e6 |........B....6x.|
+| 8e d1 fe 3d f0 48 |...=.H |
+Plaintext[22]:
+| 01 00 4b 4b 49 51 ed ba 72 1d 18 99 e9 4b 23 e6 |..KKIQ..r....K#.|
+| ae 9a 0f 2b b5 ab |...+.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4b 4b 49 51 ed ba 72 1d 18 99 e9 4b 23 e6 ae 9a |KKIQ..r....K#...|
+| 0f 2b b5 ab |.+.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #79 (first time)
+ssl_session_init: initializing ptr 0x7fb94d3d2f10 size 688
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 57651 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4491
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #81 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC011 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| e7 39 8c df 37 50 e1 0f e7 e1 d5 f7 ba f3 64 6a |.9..7P........dj|
+| f4 d2 bc 09 66 46 fe db b7 e1 1b c3 53 38 e1 52 |....fF......S8.R|
+| 4f 6b d2 04 93 78 99 09 69 f6 07 7c ea 50 32 02 |Ok...x..i..|.P2.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6f f5 72 18 16 e7 99 83 fc eb 41 bd 2f a7 36 98 |o.r.......A./.6.|
+| bf 06 09 85 5b fe 45 8c 85 8e 60 b9 e3 52 34 c6 |....[.E...`..R4.|
+| 6f 71 3a 14 92 79 33 aa 65 11 63 5d de b2 6c a1 |oq:..y3.e.c]..l.|
+| 55 13 a6 01 34 59 1d d5 27 e9 e8 5b c1 |U...4Y..'..[. |
+hash out[72]:
+| af 1d f5 51 e1 8b 19 75 6e d4 11 11 77 7a 4a 40 |...Q...un...wzJ@|
+| b5 71 03 e8 69 f3 c0 19 a5 11 15 8b 5b 47 5f 85 |.q..i.......[G_.|
+| 3f bd 6c b8 52 78 49 1f 00 eb 93 52 01 64 1a a6 |?.l.RxI....R.d..|
+| ff 7c 3f 9f 81 61 77 9b 32 49 44 4c 53 28 07 8f |.|?..aw.2IDLS(..|
+| 52 5a dd 6e 87 d8 e9 d4 |RZ.n.... |
+PRF out[72]:
+| af 1d f5 51 e1 8b 19 75 6e d4 11 11 77 7a 4a 40 |...Q...un...wzJ@|
+| b5 71 03 e8 69 f3 c0 19 a5 11 15 8b 5b 47 5f 85 |.q..i.......[G_.|
+| 3f bd 6c b8 52 78 49 1f 00 eb 93 52 01 64 1a a6 |?.l.RxI....R.d..|
+| ff 7c 3f 9f 81 61 77 9b 32 49 44 4c 53 28 07 8f |.|?..aw.2IDLS(..|
+| 52 5a dd 6e 87 d8 e9 d4 |RZ.n.... |
+key expansion[72]:
+| af 1d f5 51 e1 8b 19 75 6e d4 11 11 77 7a 4a 40 |...Q...un...wzJ@|
+| b5 71 03 e8 69 f3 c0 19 a5 11 15 8b 5b 47 5f 85 |.q..i.......[G_.|
+| 3f bd 6c b8 52 78 49 1f 00 eb 93 52 01 64 1a a6 |?.l.RxI....R.d..|
+| ff 7c 3f 9f 81 61 77 9b 32 49 44 4c 53 28 07 8f |.|?..aw.2IDLS(..|
+| 52 5a dd 6e 87 d8 e9 d4 |RZ.n.... |
+Client MAC key[20]:
+| af 1d f5 51 e1 8b 19 75 6e d4 11 11 77 7a 4a 40 |...Q...un...wzJ@|
+| b5 71 03 e8 |.q.. |
+Server MAC key[20]:
+| 69 f3 c0 19 a5 11 15 8b 5b 47 5f 85 3f bd 6c b8 |i.......[G_.?.l.|
+| 52 78 49 1f |RxI. |
+Client Write key[16]:
+| 00 eb 93 52 01 64 1a a6 ff 7c 3f 9f 81 61 77 9b |...R.d...|?..aw.|
+Server Write key[16]:
+| 32 49 44 4c 53 28 07 8f 52 5a dd 6e 87 d8 e9 d4 |2IDLS(..RZ.n....|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #83 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/works/premaster.txt
+looking for CLIENT_RANDOM 5234c66f713a14927933aa6511635ddeb26ca15513a60134...
+looking for RSA pre-master4104d14f1651aa51a05bd5c9d4b3c9f95882a8f671808b91...
+ checking keylog line: CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8ff18262ab227e698 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed7431ad374c1699d8f911d241070e4afd8fba7c697ae5c8fa12ec184 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66eee73fea21eb7ef62cf264d205d6fcd7841f949adf80bc6c703e4c264 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e035f0cddbb9b4d52bec23d49e58691e0cce1bde6b4ded568c8c82a76 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66ed09828f0597ac302344b0c01622ea095760ec417a104182895f9d8f4 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e96876398ad6ecff1b3ffb758719bb51258eaea31bb97a4be4e7eca41 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66e233fc95eee0a92ea667ab411bfcc026162366319ff18f4bbd8be92cb E7398CDF3750E10FE7E1D5F7BAF3646AF4D2BC096646FEDBB7E11BC35338E1524F6BD2049378990969F6077CEA503202
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66efe0dbbea44df8c5a20597bf215e5802c26d4b524cf1967055a742ec6 E7398CDF3750E10FE7E1D5F7BAF3646AF4D2BC096646FEDBB7E11BC35338E1524F6BD2049378990969F6077CEA503202
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234c66f713a14927933aa6511635ddeb26ca15513a60134591dd527e9e85bc1 92CEACE9E21D204EF277392C265FEEE28E0220BE3309B601464AE2FED0C725FC8FD6C9A35C0CCA8091386BFC5FB17FD4
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 92 ce ac e9 e2 1d 20 4e f2 77 39 2c 26 5f ee e2 |...... N.w9,&_..|
+| 8e 02 20 be 33 09 b6 01 46 4a e2 fe d0 c7 25 fc |.. .3...FJ....%.|
+| 8f d6 c9 a3 5c 0c ca 80 91 38 6b fc 5f b1 7f d4 |....\....8k._...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c6 |key expansionR4.|
+| 6f f5 72 18 16 e7 99 83 fc eb 41 bd 2f a7 36 98 |o.r.......A./.6.|
+| bf 06 09 85 5b fe 45 8c 85 8e 60 b9 e3 52 34 c6 |....[.E...`..R4.|
+| 6f 71 3a 14 92 79 33 aa 65 11 63 5d de b2 6c a1 |oq:..y3.e.c]..l.|
+| 55 13 a6 01 34 59 1d d5 27 e9 e8 5b c1 |U...4Y..'..[. |
+hash out[72]:
+| 83 51 26 4e 2d c4 58 de 68 b8 43 5e 36 0e 70 90 |.Q&N-.X.h.C^6.p.|
+| 32 b1 b2 49 dc 61 63 b4 b4 75 6c d3 78 87 27 22 |2..I.ac..ul.x.'"|
+| df 87 17 e3 ee db 0c 00 e5 05 89 4e 06 1c 38 18 |...........N..8.|
+| 04 1a a8 29 cf 92 f9 cd a2 f1 21 88 9d 01 6c b5 |...)......!...l.|
+| 68 46 dc 59 06 24 74 54 |hF.Y.$tT |
+PRF out[72]:
+| 83 51 26 4e 2d c4 58 de 68 b8 43 5e 36 0e 70 90 |.Q&N-.X.h.C^6.p.|
+| 32 b1 b2 49 dc 61 63 b4 b4 75 6c d3 78 87 27 22 |2..I.ac..ul.x.'"|
+| df 87 17 e3 ee db 0c 00 e5 05 89 4e 06 1c 38 18 |...........N..8.|
+| 04 1a a8 29 cf 92 f9 cd a2 f1 21 88 9d 01 6c b5 |...)......!...l.|
+| 68 46 dc 59 06 24 74 54 |hF.Y.$tT |
+key expansion[72]:
+| 83 51 26 4e 2d c4 58 de 68 b8 43 5e 36 0e 70 90 |.Q&N-.X.h.C^6.p.|
+| 32 b1 b2 49 dc 61 63 b4 b4 75 6c d3 78 87 27 22 |2..I.ac..ul.x.'"|
+| df 87 17 e3 ee db 0c 00 e5 05 89 4e 06 1c 38 18 |...........N..8.|
+| 04 1a a8 29 cf 92 f9 cd a2 f1 21 88 9d 01 6c b5 |...)......!...l.|
+| 68 46 dc 59 06 24 74 54 |hF.Y.$tT |
+Client MAC key[20]:
+| 83 51 26 4e 2d c4 58 de 68 b8 43 5e 36 0e 70 90 |.Q&N-.X.h.C^6.p.|
+| 32 b1 b2 49 |2..I |
+Server MAC key[20]:
+| dc 61 63 b4 b4 75 6c d3 78 87 27 22 df 87 17 e3 |.ac..ul.x.'"....|
+| ee db 0c 00 |.... |
+Client Write key[16]:
+| e5 05 89 4e 06 1c 38 18 04 1a a8 29 cf 92 f9 cd |...N..8....)....|
+Server Write key[16]:
+| a2 f1 21 88 9d 01 6c b5 68 46 dc 59 06 24 74 54 |..!...l.hF.Y.$tT|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 35 72 03 00 00 00 00 |@5r..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 92 ce ac e9 e2 1d 20 4e f2 77 39 2c 26 5f ee e2 |...... N.w9,&_..|
+| 8e 02 20 be 33 09 b6 01 46 4a e2 fe d0 c7 25 fc |.. .3...FJ....%.|
+| 8f d6 c9 a3 5c 0c ca 80 91 38 6b fc 5f b1 7f d4 |....\....8k._...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 2b 0a f5 42 af d7 15 1d 3f 4c c4 40 71 6f 3a e1 |+..B....?L.@qo:.|
+| 09 a1 a3 7d a0 7c 39 35 6c f0 67 9f 5c 8b c4 10 |...}.|95l.g.\...|
+| ea 8b 65 2b |..e+ |
+Plaintext[36]:
+| 14 00 00 0c 36 6b 9b 1f 52 e9 70 b4 16 02 78 03 |....6k..R.p...x.|
+| e9 b5 14 e1 69 bb 25 4b 18 94 5d a0 54 e1 b5 00 |....i.%K..].T...|
+| f4 0a 67 74 |..gt |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e9 b5 14 e1 69 bb 25 4b 18 94 5d a0 54 e1 b5 00 |....i.%K..].T...|
+| f4 0a 67 74 |..gt |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #84 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 9d 19 6f a0 2d 33 42 8e 24 72 94 7f e0 52 05 91 |..o.-3B.$r...R..|
+| 9a 19 63 77 56 2d c0 c4 22 ef a2 80 09 d8 93 ab |..cwV-..".......|
+| ff 2b dd 04 |.+.. |
+Plaintext[36]:
+| 14 00 00 0c ed c0 d1 2a 8d 7c 12 be 6b b7 0a 72 |.......*.|..k..r|
+| 10 6f 38 97 f8 44 6b d0 c3 cd 92 16 38 a4 f9 06 |.o8..Dk.....8...|
+| 40 2e 41 98 |@.A. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 10 6f 38 97 f8 44 6b d0 c3 cd 92 16 38 a4 f9 06 |.o8..Dk.....8...|
+| 40 2e 41 98 |@.A. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #85 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 96
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 91, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 91
+Ciphertext[91]:
+| 60 97 53 c5 c4 13 c8 01 99 28 ee ce df 78 25 b3 |`.S......(...x%.|
+| e1 da 6f 8b 34 b1 af 21 a0 e6 0a 12 c5 fe b0 13 |..o.4..!........|
+| c0 0a c9 de 38 06 a0 8c b4 de a0 4a 96 60 c0 0e |....8......J.`..|
+| 95 fc 7b 68 69 07 d2 89 02 bd 96 b2 54 f2 4d c8 |..{hi.......T.M.|
+| 98 a1 06 c0 73 6d 0d 89 57 7f 13 4d 42 cd 5c 65 |....sm..W..MB.\e|
+| 88 aa 3c cd c1 41 63 90 7b 55 61 |..<..Ac.{Ua |
+Plaintext[91]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a 8d 37 a3 57 b7 34 8a 87 09 |491.....7.W.4...|
+| e2 4e 07 57 7a 18 0b fd ae f4 e2 |.N.Wz...... |
+checking mac (len 71, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d 37 a3 57 b7 34 8a 87 09 e2 4e 07 57 7a 18 0b |.7.W.4....N.Wz..|
+| fd ae f4 e2 |.... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 71, seq = 0, nxtseq = 71
+association_find: TCP port 57651 found (nil)
+association_find: TCP port 4491 found 0x3417f80
+dissect_ssl3_record decrypted len 71
+decrypted app data fragment[71]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a |491.... |
+dissect_ssl3_record found association 0x3417f80
+
+dissect_ssl enter frame #86 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| 13 e1 d1 ca 3d 4a 7a 4e f3 af 8e f8 d6 e7 ae 83 |....=JzN........|
+| 78 a0 75 a2 eb e1 d3 14 63 7c d6 7d f7 16 77 c0 |x.u.....c|.}..w.|
+| ab 07 d5 a9 24 15 06 b8 5b ca 60 f2 8a 8e 61 d4 |....$...[.`...a.|
+| 2c 2e 02 a9 5f 02 de de 3b be 5f 0b ee 69 72 09 |,..._...;._..ir.|
+| 4d 65 99 e4 10 75 10 12 73 c3 c3 18 91 12 ca 03 |Me...u..s.......|
+| a9 75 a7 c5 50 7b fd 22 6f ac ed 5b 2e 3d 0d 9b |.u..P{."o..[.=..|
+| 05 b1 a8 0f 98 80 39 52 4c 84 f2 18 f3 99 e2 f9 |......9RL.......|
+| 8f 58 7f 10 0c 79 5d b2 0d 5f df e5 a4 cb 9a 35 |.X...y].._.....5|
+| c4 d8 33 00 f2 dd 30 71 2e 34 41 58 b1 f7 25 2b |..3...0q.4AX..%+|
+| e7 3b a5 f4 0e 7b 8c cb 15 cf c8 79 8f d9 bb 6e |.;...{.....y...n|
+| 57 86 70 7b 03 c5 1d d2 e7 6e e0 89 26 12 cc 53 |W.p{.....n..&..S|
+| e4 f1 10 66 6f 4f 0e 7c 32 a0 72 78 ab 20 a6 59 |...foO.|2.rx. .Y|
+| 54 a2 b0 2b e8 ca 10 93 b9 84 6f 62 4d 78 6a d4 |T..+......obMxj.|
+| 2a 8d c1 17 b3 de b2 6f ae 52 88 bc 57 4e 20 5d |*......o.R..WN ]|
+| e9 04 fd 6d d5 91 46 e0 9c 89 2f f9 d0 21 9d 31 |...m..F.../..!.1|
+| 49 1a 69 49 ec 44 50 1f 6b 39 76 4b a1 37 3f c8 |I.iI.DP.k9vK.7?.|
+| 88 73 b4 7c 7e ed 01 95 1a a9 87 b9 b4 be 72 d0 |.s.|~.........r.|
+| 2e 0d 4d 37 9a ff 2a 02 bb a2 61 6c de db 03 0c |..M7..*...al....|
+| 78 ab c7 0b 28 48 ac 44 c3 00 5d 4c a2 a8 e0 e1 |x...(H.D..]L....|
+| f3 c0 80 f0 05 e4 24 7e 77 81 a6 77 45 12 9c 75 |......$~w..wE..u|
+| cb 81 98 dc d8 19 21 bf 19 92 a3 16 50 0f 12 bc |......!.....P...|
+| 26 37 aa e6 f2 40 3a 05 45 45 7a 0e c5 e1 1b c2 |&7...@:.EEz.....|
+| df 73 8d 4d 96 c8 fc 2d 0c fb 6a 20 8d 4f 6b 85 |.s.M...-..j .Ok.|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 88 3e fc 19 |nl'</script>.>..|
+| 1b 3f 94 3a 68 89 7e 8b cb 4a 9b 76 0f 36 d5 92 |.?.:h.~..J.v.6..|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 3e fc 19 1b 3f 94 3a 68 89 7e 8b cb 4a 9b 76 |.>...?.:h.~..J.v|
+| 0f 36 d5 92 |.6.. |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4491 found 0x3417f80
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:23 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3417f80
+
+dissect_ssl enter frame #87 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| ce 81 38 7e 9d d0 c6 b4 d2 0e a2 0c 0f 8b 04 83 |..8~............|
+| 85 36 13 93 de dc |.6.... |
+Plaintext[22]:
+| 01 00 e3 6f 58 8c c2 2f d8 22 98 40 2a ef 28 86 |...oX../.".@*.(.|
+| 32 da 03 7e dc ae |2..~.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 6f 58 8c c2 2f d8 22 98 40 2a ef 28 86 32 da |.oX../.".@*.(.2.|
+| 03 7e dc ae |.~.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #89 (first time)
+ conversation = 0x7fb97956c128, ssl_session = 0x7fb94d3d2f10
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 76 94 99 f9 cc f0 65 88 de a2 85 ef 48 e9 22 a3 |v.....e.....H.".|
+| 22 75 50 fb 1c 5a |"uP..Z |
+Plaintext[22]:
+| 01 00 d7 3f 33 08 b6 93 fb 2e 51 3c 92 9d 60 7b |...?3.....Q<..`{|
+| 6c 0c d1 99 43 f4 |l...C. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d7 3f 33 08 b6 93 fb 2e 51 3c 92 9d 60 7b 6c 0c |.?3.....Q<..`{l.|
+| d1 99 43 f4 |..C. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #4 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+
+dissect_ssl enter frame #6 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 40347 found (nil)
+association_find: TCP port 4434 found 0x33e0300
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33e0300
+
+dissect_ssl enter frame #11 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 4434 found 0x33e0300
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:|
+| 32 36 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |26:21 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33e0300
+
+dissect_ssl enter frame #12 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+
+dissect_ssl enter frame #14 (already visited)
+ conversation = 0x7fb97956b088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
diff --git a/tls/works/dump.pcapng b/tls/works/dump.pcapng
new file mode 100644
index 0000000..572d671
--- /dev/null
+++ b/tls/works/dump.pcapng
Binary files differ
diff --git a/tls/works/premaster.txt b/tls/works/premaster.txt
new file mode 100644
index 0000000..9661deb
--- /dev/null
+++ b/tls/works/premaster.txt
@@ -0,0 +1,12 @@
+CLIENT_RANDOM 5234c66d868de84097daee7e21c41d2e9fe9605f05b0ceaf7eb7958c33423fd5 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+CLIENT_RANDOM 5234c66d51c0ad1d27eb8be3ed76efe3209e04bf7d806842d63012058ed50e60 ED6402EABFA651B28A7B44ED8CCE91361D0145CA643F91D8DDD9D1C8EA62C238BA78146FB97798332820CD9F392ACFF8
+CLIENT_RANDOM 5234c66e95f5270d00e973709aa0b3dbd52a8023cac55ff8ff18262ab227e698 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+CLIENT_RANDOM 5234c66ed7431ad374c1699d8f911d241070e4afd8fba7c697ae5c8fa12ec184 3258F44EB700BE97764004AC92339CADA43E24159E567B8D4169ADBBC6485F756C51F952720B99FC81E16FD75CA886DC
+CLIENT_RANDOM 5234c66eee73fea21eb7ef62cf264d205d6fcd7841f949adf80bc6c703e4c264 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+CLIENT_RANDOM 5234c66e035f0cddbb9b4d52bec23d49e58691e0cce1bde6b4ded568c8c82a76 73725178335F5DFF0525C6480DC4A0EF917069E418DD54167A64C267D93C5B640883A2C80B60D4501F40E44286C1BF98
+CLIENT_RANDOM 5234c66ed09828f0597ac302344b0c01622ea095760ec417a104182895f9d8f4 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+CLIENT_RANDOM 5234c66e96876398ad6ecff1b3ffb758719bb51258eaea31bb97a4be4e7eca41 26F08678B7115A898862D8C3EE827E1B8A134C43F218B1E54ED027692F891A405E532DF1F53BDF6E443D5AD233CDE063
+CLIENT_RANDOM 5234c66e233fc95eee0a92ea667ab411bfcc026162366319ff18f4bbd8be92cb E7398CDF3750E10FE7E1D5F7BAF3646AF4D2BC096646FEDBB7E11BC35338E1524F6BD2049378990969F6077CEA503202
+CLIENT_RANDOM 5234c66efe0dbbea44df8c5a20597bf215e5802c26d4b524cf1967055a742ec6 E7398CDF3750E10FE7E1D5F7BAF3646AF4D2BC096646FEDBB7E11BC35338E1524F6BD2049378990969F6077CEA503202
+CLIENT_RANDOM 5234c66f713a14927933aa6511635ddeb26ca15513a60134591dd527e9e85bc1 92CEACE9E21D204EF277392C265FEEE28E0220BE3309B601464AE2FED0C725FC8FD6C9A35C0CCA8091386BFC5FB17FD4
+CLIENT_RANDOM 5234c66ff5721816e79983fceb41bd2fa73698bf0609855bfe458c858e60b9e3 92CEACE9E21D204EF277392C265FEEE28E0220BE3309B601464AE2FED0C725FC8FD6C9A35C0CCA8091386BFC5FB17FD4