summaryrefslogtreecommitdiff
path: root/tls/all
diff options
context:
space:
mode:
Diffstat (limited to 'tls/all')
-rw-r--r--tls/all/ciphers-V-broken.txt33
-rw-r--r--tls/all/ciphers-V-works.txt6
-rw-r--r--tls/all/debug.txt20504
-rw-r--r--tls/all/dump.pcapngbin0 -> 152764 bytes
-rw-r--r--tls/all/premaster.txt78
-rw-r--r--tls/all/tls-urls.txt39
-rw-r--r--tls/all/wireshark-broken.txt33
-rw-r--r--tls/all/wireshark-works.txt6
8 files changed, 20699 insertions, 0 deletions
diff --git a/tls/all/ciphers-V-broken.txt b/tls/all/ciphers-V-broken.txt
new file mode 100644
index 0000000..f190408
--- /dev/null
+++ b/tls/all/ciphers-V-broken.txt
@@ -0,0 +1,33 @@
+ 0xC0,0x14 - ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
+ 0xC0,0x0A - ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
+ 0x00,0x39 - DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
+ 0x00,0x38 - DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1
+ 0x00,0x88 - DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
+ 0x00,0x87 - DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(256) Mac=SHA1
+ 0xC0,0x05 - ECDH-ECDSA-AES256-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256) Mac=SHA1
+ 0x00,0x35 - AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
+ 0x00,0x84 - CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1
+ 0xC0,0x12 - ECDHE-RSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=RSA Enc=3DES(168) Mac=SHA1
+ 0xC0,0x08 - ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=3DES(168) Mac=SHA1
+ 0x00,0x16 - EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1
+ 0x00,0x13 - EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1
+ 0xC0,0x03 - ECDH-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=3DES(168) Mac=SHA1
+ 0x00,0x0A - DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
+ 0xC0,0x13 - ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
+ 0xC0,0x09 - ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
+ 0x00,0x33 - DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
+ 0x00,0x32 - DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1
+ 0x00,0x9A - DHE-RSA-SEED-SHA SSLv3 Kx=DH Au=RSA Enc=SEED(128) Mac=SHA1
+ 0x00,0x99 - DHE-DSS-SEED-SHA SSLv3 Kx=DH Au=DSS Enc=SEED(128) Mac=SHA1
+ 0x00,0x45 - DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1
+ 0x00,0x44 - DHE-DSS-CAMELLIA128-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(128) Mac=SHA1
+ 0xC0,0x04 - ECDH-ECDSA-AES128-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(128) Mac=SHA1
+ 0x00,0x2F - AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
+ 0x00,0x96 - SEED-SHA SSLv3 Kx=RSA Au=RSA Enc=SEED(128) Mac=SHA1
+ 0x00,0x41 - CAMELLIA128-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA1
+ 0x00,0x07 - IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1
+ 0x00,0x15 - EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1
+ 0x00,0x12 - EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1
+ 0x00,0x09 - DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
+ 0x00,0x08 - EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
+ 0x00,0x06 - EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
diff --git a/tls/all/ciphers-V-works.txt b/tls/all/ciphers-V-works.txt
new file mode 100644
index 0000000..c3bd131
--- /dev/null
+++ b/tls/all/ciphers-V-works.txt
@@ -0,0 +1,6 @@
+ 0xC0,0x11 - ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1
+ 0xC0,0x07 - ECDHE-ECDSA-RC4-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=RC4(128) Mac=SHA1
+ 0xC0,0x02 - ECDH-ECDSA-RC4-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=RC4(128) Mac=SHA1
+ 0x00,0x05 - RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
+ 0x00,0x04 - RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
+ 0x00,0x03 - EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
diff --git a/tls/all/debug.txt b/tls/all/debug.txt
new file mode 100644
index 0000000..668877e
--- /dev/null
+++ b/tls/all/debug.txt
@@ -0,0 +1,20504 @@
+Wireshark SSL debug log
+
+
+dissect_ssl enter frame #4 (first time)
+ssl_session_init: initializing ptr 0x7facc380f060 size 688
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 40165 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4434
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #6 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session can't find stored session
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+found master secret in key log
+ cannot find master secret in keylog file either
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..|
+| bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.|
+| 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..|
+| e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. |
+hash out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+PRF out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+key expansion[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 f7 1b 5e 87 |...^. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+PRF out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| bd 24 1f e8 5a |.$..Z |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+PRF out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+Client MAC key[16]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+Server MAC key[16]:
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+Client Write key[16]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+Server Write key[16]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 52 11 00 00 00 00 00 00 |R....... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab...
+looking for RSA pre-masteraaf9896cd26391408e582a9fe4c1454d18e1935c79f420c9...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..|
+| bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.|
+| 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..|
+| e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. |
+hash out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+PRF out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+key expansion[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 f7 1b 5e 87 |...^. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+PRF out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| bd 24 1f e8 5a |.$..Z |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+PRF out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+Client MAC key[16]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+Server MAC key[16]:
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+Client Write key[16]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+Server Write key[16]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ab 1f 53 b0 d4 2c d5 d9 3a d2 9d 10 94 17 c2 c7 |..S..,..:.......|
+| 8f 46 0e 99 0b 6e eb a6 95 9e 9d 41 31 7a b5 71 |.F...n.....A1z.q|
+Plaintext[32]:
+| 14 00 00 0c 5d c6 d2 8c 1a 80 f1 2e fb 70 e7 68 |....]........p.h|
+| 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 7b 0f 3a 4f 01 75 7f c4 33 6f 0a bc a6 a2 50 67 |{.:O.u..3o....Pg|
+| a4 c8 58 70 89 81 ed 24 6d 43 34 8c 9c ca 15 e0 |..Xp...$mC4.....|
+Plaintext[32]:
+| 14 00 00 0c 0b 09 b9 f9 94 8b 80 5f e6 42 81 6b |..........._.B.k|
+| 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 3e 0d ba 3e 4a 7e 7a 46 bf b9 9c 3f 31 f8 b2 0f |>..>J~zF...?1...|
+| 69 64 7c 7a 30 22 ce 38 45 4b 81 31 00 a9 41 57 |id|z0".8EK.1..AW|
+| b4 dd 58 41 f0 0e 11 23 4b 29 44 47 46 73 b3 7f |..XA...#K)DGFs..|
+| ed 45 37 c9 3b 0c 33 4f 55 54 f0 21 c1 05 0b 19 |.E7.;.3OUT.!....|
+| 9a be 8f 5d c4 70 c9 60 74 b0 94 5b 23 ee 84 a6 |...].p.`t..[#...|
+| 48 |H |
+ssl_decrypt_record: allocating 113 bytes for decrypt data (old len 32)
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 |.C"..-........N.|
+| 2f |/ |
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 2f |C"..-........N./|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65
+association_find: TCP port 40165 found (nil)
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #11 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 371, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 371
+Ciphertext[371]:
+| b6 de 1f 5a df ae ce 3e 4a 6e 21 25 a2 47 06 25 |...Z...>Jn!%.G.%|
+| f6 fd bb 49 e7 a4 6a bc 89 32 6f 22 14 eb 8f 3e |...I..j..2o"...>|
+| 05 bc d5 bf df b2 19 7b 64 fa 62 c5 96 15 7b 0a |.......{d.b...{.|
+| a6 50 cd d2 4c 3f 5c 2b 20 fc 8b d4 d9 2b db 99 |.P..L?\+ ....+..|
+| e4 14 36 ec 8d dd 42 74 20 e6 fa c6 34 1a d1 b6 |..6...Bt ...4...|
+| 2d 74 a1 00 7b 11 e2 a8 70 f1 96 63 32 0b 44 4f |-t..{...p..c2.DO|
+| b1 45 25 70 71 74 95 28 7f 55 5b e4 f3 39 df 53 |.E%pqt.(.U[..9.S|
+| 14 e4 5a 3a 43 f5 9d 0b 9d ad 81 ff 06 fe 57 eb |..Z:C.........W.|
+| f0 b9 e1 c9 14 45 1c 55 7b 26 da 08 6d a1 0b 71 |.....E.U{&..m..q|
+| a1 60 e9 c3 2e a1 a3 89 58 5e 21 6a 17 98 2d dd |.`......X^!j..-.|
+| b4 09 e8 af 88 2b 58 f1 66 23 38 95 f3 32 ad 59 |.....+X.f#8..2.Y|
+| 62 cf cb fc c3 84 fd 33 5a 45 5e 61 28 10 f3 2c |b......3ZE^a(..,|
+| 69 73 af 99 37 44 55 ab 1f 1d 17 be 38 cb f0 6b |is..7DU.....8..k|
+| 79 ea bf 8f 80 d4 49 6b 20 2c 57 c9 b1 48 d7 7a |y.....Ik ,W..H.z|
+| f9 f2 4a 56 cd 68 20 34 d9 47 27 fe 00 6b 19 07 |..JV.h 4.G'..k..|
+| 2c 55 ac 38 35 b1 98 e9 bb 02 ed ab 01 c9 38 2c |,U.85.........8,|
+| 87 2e b0 da d3 7d 5b 39 07 cb fb f3 6d 95 91 9c |.....}[9....m...|
+| 84 92 90 3c 34 7f ed aa 7e 22 e9 99 a5 b4 90 7b |...<4...~".....{|
+| 61 f9 6b 96 b7 3c a8 27 76 e6 87 35 d4 f9 67 67 |a.k..<.'v..5..gg|
+| f2 64 bb e3 6e a9 12 ab 42 e3 ca 14 90 44 c2 e6 |.d..n...B....D..|
+| 76 ad e2 f6 17 af a7 68 fd b0 21 95 f2 bb d6 b6 |v......h..!.....|
+| e2 fb 59 af 27 31 d9 f1 4d 2f fb d8 d8 b3 06 48 |..Y.'1..M/.....H|
+| ab 1a af 4d a3 79 58 19 a9 42 ce c2 e0 c1 bd 83 |...M.yX..B......|
+| dc 58 e3 |.X. |
+ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 113)
+Plaintext[371]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d |pt>....;D..f..G-|
+| dd 1e eb |... |
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d dd 1e eb |....;D..f..G-...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #12 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 35 00 7c 44 00 05 fc 63 be 79 45 3f d5 59 a6 77 |5.|D...c.yE?.Y.w|
+| a4 7a |.z |
+Plaintext[18]:
+| 01 00 e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 |...a4...U.....R.|
+| 8f b2 |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 8f b2 |.a4...U.....R...|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #14 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| f9 ee 0f 6c 4b 2e f9 71 f6 c7 eb d5 b4 cb 78 2a |...lK..q......x*|
+| c7 a3 |.. |
+Plaintext[18]:
+| 01 00 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 |..{[..3^...+..ZX|
+| 1d a0 |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 1d a0 |{[..3^...+..ZX..|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #19 (first time)
+ssl_session_init: initializing ptr 0x7facc38119d0 size 688
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46195 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4435
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #21 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{|
+| 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.|
+| 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....|
+| 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... |
+hash out[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+PRF out[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+key expansion[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+Client MAC key[16]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+Server MAC key[16]:
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+Client Write key[16]:
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+Server Write key[16]:
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #23 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 310
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364e...
+looking for RSA pre-master808f0a3961b6859682b36eb63335dbdfe3e0ea7aa788787e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{|
+| 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.|
+| 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....|
+| 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... |
+hash out[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+PRF out[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+key expansion[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+Client MAC key[16]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+Server MAC key[16]:
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+Client Write key[16]:
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+Server Write key[16]:
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 bd 73 03 00 00 00 00 |@.s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e8 4a 32 ba 83 bb c0 cd 12 c5 82 7e f5 d4 95 6d |.J2........~...m|
+| 72 f4 32 fd e4 31 29 10 48 6a 07 2f 47 77 04 94 |r.2..1).Hj./Gw..|
+Plaintext[32]:
+| 14 00 00 0c c8 4b 0b 55 9f 72 f5 13 a3 e9 69 bf |.....K.U.r....i.|
+| 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #24 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 44 03 b0 93 8e 51 2a 28 92 af d6 37 31 c9 4c 90 |D....Q*(...71.L.|
+| dc be 73 5e 73 74 bd ca 03 c8 ad 34 08 23 1c b4 |..s^st.....4.#..|
+Plaintext[32]:
+| 14 00 00 0c 18 0b 80 a3 9b d5 02 4c 96 a6 a1 65 |...........L...e|
+| 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #25 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 82
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 77, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 77
+Ciphertext[77]:
+| 60 6f e0 5f f0 8a 20 20 46 e7 f5 44 f8 57 c7 1d |`o._.. F..D.W..|
+| 00 82 b8 12 b4 3f 78 97 43 ef ac be dd 6a 76 29 |.....?x.C....jv)|
+| cb 31 5b 62 64 70 ed 86 fc 60 5c dd f3 8b d5 c0 |.1[bdp...`\.....|
+| 38 61 b7 a7 df be 5d 3a 30 66 19 54 be 3c 35 cd |8a....]:0f.T.<5.|
+| 14 27 47 24 73 56 61 84 0e 42 9c e5 5f |.'G$sVa..B.._ |
+Plaintext[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a 21 89 fe |n.nl:4435....!..|
+| cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |....!o...F... |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 21 89 fe cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |!......!o...F...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 46195 found (nil)
+association_find: TCP port 4435 found 0x34254c0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... |
+dissect_ssl3_record found association 0x34254c0
+
+dissect_ssl enter frame #26 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 368
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 363, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 363
+Ciphertext[363]:
+| e5 44 fb 83 4b 56 20 00 62 db a3 09 c9 55 30 0b |.D..KV .b....U0.|
+| 9e 0c 85 05 a6 a4 47 92 3a 04 7d 8c bc 71 1e 1c |......G.:.}..q..|
+| 6d a8 a6 40 d3 a6 42 64 e0 ea c7 b5 a9 92 dd 31 |m..@..Bd.......1|
+| fc 75 04 55 f1 24 8d 54 44 3e 8a f1 0f a6 8d a1 |.u.U.$.TD>......|
+| bb e1 20 7c 2e ee 89 5f 88 5c 9f 2c 41 ea b3 92 |.. |..._.\.,A...|
+| c1 99 6f 92 d2 ca 7b 66 3e bd f3 ce 94 1c 0e 20 |..o...{f>...... |
+| 03 75 48 62 b7 98 1c 70 fd 8c 66 80 ff 5d 91 c6 |.uHb...p..f..]..|
+| 39 9a 42 b8 92 bc 6c 97 bc 77 92 37 01 c5 24 59 |9.B...l..w.7..$Y|
+| 85 0b f1 a0 89 1e 46 53 58 6e f4 64 54 47 87 77 |......FSXn.dTG.w|
+| c7 eb f7 16 40 18 74 44 98 69 d3 49 cf b0 9a 83 |....@.tD.i.I....|
+| 86 b4 a0 46 c6 42 ce ee f0 f5 fb c2 47 19 d3 01 |...F.B......G...|
+| ce 90 3c ac 4a e1 82 f4 19 81 7c b8 dc db a5 34 |..<.J.....|....4|
+| 3c ac 6c 98 db 64 b1 8f 7e 8d 45 64 99 1e b7 c3 |<.l..d..~.Ed....|
+| 16 50 2c 09 57 61 d3 aa e8 f9 bd a2 cd 65 d1 1f |.P,.Wa.......e..|
+| d2 6c 3b f7 6c 57 2c 3c 9e 85 95 4b e9 b4 54 ee |.l;.lW,<...K..T.|
+| ba 85 bc 7e 92 dc 85 54 86 db ef b0 bd 76 2a d6 |...~...T.....v*.|
+| 8f d3 4a f0 e0 a9 ba 89 24 3d 6b 71 c1 31 7e 91 |..J.....$=kq.1~.|
+| c3 3e e1 4a da 23 5a 0a 2a 82 15 85 b0 b1 0e f0 |.>.J.#Z.*.......|
+| 64 88 a1 75 ad 0a 9c 9c b1 ab 12 a8 90 38 69 a9 |d..u.........8i.|
+| fd 3e cb 85 45 a1 32 42 fd ba 77 f7 53 74 f8 17 |.>..E.2B..w.St..|
+| ca 5f d6 d8 f8 99 99 85 47 14 e6 cd 4f 0f 76 d5 |._......G...O.v.|
+| 1d bc 93 22 53 75 56 a2 34 0f ed 53 d7 2b a5 27 |..."SuV.4..S.+.'|
+| 6a 17 c8 e0 f7 04 2a 86 da c3 33 |j.....*...3 |
+Plaintext[363]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 14 32 51 46 1a |l'</script>.2QF.|
+| 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |^s......a.. |
+checking mac (len 347, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 14 32 51 46 1a 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |.2QF.^s......a..|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347
+association_find: TCP port 4435 found 0x34254c0
+dissect_ssl3_record decrypted len 347
+decrypted app data fragment[347]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e |l'</script> |
+dissect_ssl3_record found association 0x34254c0
+
+dissect_ssl enter frame #27 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| fa 16 da a9 91 b0 7c 04 81 10 a2 25 50 28 d2 07 |......|....%P(..|
+| ac 34 |.4 |
+Plaintext[18]:
+| 01 00 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 |.......B...8.np.|
+| 34 a4 |4. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 34 a4 |.....B...8.np.4.|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #29 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 69 b5 40 b5 50 76 16 cc 5b 06 0d 7f c4 24 6b 1a |i.@.Pv..[....$k.|
+| dc 72 |.r |
+Plaintext[18]:
+| 01 00 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 |...%5n......#..b|
+| c0 36 |.6 |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 c0 36 |.%5n......#..b.6|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #34 (first time)
+ssl_session_init: initializing ptr 0x7facc3814390 size 688
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52548 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4436
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #36 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..|
+| da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.|
+| 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z|
+| 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |....<N.~.E.9. |
+hash out[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+PRF out[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+key expansion[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+Client MAC key[20]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 |dt.. |
+Server MAC key[20]:
+| d0 96 ab db 02 a7 a3 67 a8 24 dc ce b7 9c 03 1f |.......g.$......|
+| ad 04 25 e2 |..%. |
+Client Write key[16]:
+| d9 28 da 0a 59 18 53 a3 a6 21 54 e0 c0 6b 63 4a |.(..Y.S..!T..kcJ|
+Server Write key[16]:
+| 79 96 6d 4a 8e 13 7a 38 d1 4c fd 88 3a ba 89 16 |y.mJ..z8.L..:...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #38 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 314
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c...
+looking for RSA pre-masterb6af8c30c49aaae7d853096e912562724f72c45dc8a26642...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..|
+| da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.|
+| 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z|
+| 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |....<N.~.E.9. |
+hash out[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+PRF out[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+key expansion[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+Client MAC key[20]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b |..|{ |
+Server MAC key[20]:
+| d4 d8 49 cf e1 14 5a c8 86 34 05 3c f5 e5 b7 ff |..I...Z..4.<....|
+| f5 e9 9e c8 |.... |
+Client Write key[16]:
+| ad 1d f6 13 87 b3 cd 7c 8c c2 8a f2 51 d5 9d 09 |.......|....Q...|
+Server Write key[16]:
+| 5a 07 8f c9 cf 20 ab f2 41 6e 17 77 ac d9 cf c2 |Z.... ..An.w....|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 48 c5 28 a0 67 ce 6f 73 b3 ca 86 90 1d 1d 9c f2 |H.(.g.os........|
+| 6b f6 8a 52 24 31 22 e7 4e 2c 38 ad e6 85 ca 9c |k..R$1".N,8.....|
+| 2f f8 1d ec |/... |
+Plaintext[36]:
+| 14 00 00 0c 5e 22 3c 93 0e 06 30 b7 48 68 6e 8f |....^"<...0.Hhn.|
+| 25 99 76 9c fe af 82 ba 9d 4c c6 9c d7 92 dd de |%.v......L......|
+| 27 e9 ad 2a |'..* |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 99 76 9c fe af 82 ba 9d 4c c6 9c d7 92 dd de |%.v......L......|
+| 27 e9 ad 2a |'..* |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #39 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 51 e6 e8 5e 4e 01 4d a8 2b 86 6b 7f fa ca e4 3f |Q..^N.M.+.k....?|
+| da bf d5 17 d4 ac 4c 6a 18 86 4c a0 02 00 86 5b |......Lj..L....[|
+| 60 ac 83 bd |`... |
+Plaintext[36]:
+| 14 00 00 0c 26 b7 15 da 6e e8 de 93 82 69 0a a0 |....&...n....i..|
+| 92 ff 7b 6f fa 21 23 6f e4 ec e9 ac 44 4c 37 ca |..{o.!#o....DL7.|
+| 18 4a 67 b4 |.Jg. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 92 ff 7b 6f fa 21 23 6f e4 ec e9 ac 44 4c 37 ca |..{o.!#o....DL7.|
+| 18 4a 67 b4 |.Jg. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #40 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 71 8c 78 49 55 b2 7d d0 54 53 7b 45 da a7 14 4c |q.xIU.}.TS{E...L|
+| d2 d6 43 63 a1 02 3c 1e 36 6f 1d 7d 70 c3 7c 76 |..Cc..<.6o.}p.|v|
+| aa 80 ea f4 59 b9 b4 88 09 ad d6 5d f4 37 5e b8 |....Y......].7^.|
+| 93 4b 36 e3 c6 89 4b 7d b4 ea 25 9a a6 31 e2 64 |.K6...K}..%..1.d|
+| 6a 26 ec 66 7d e0 ab ed 81 15 7e c7 22 4f 33 b5 |j&.f}.....~."O3.|
+| f5 |. |
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a 4e ef 09 |n.nl:4436....N..|
+| 10 a3 0c b7 a7 18 03 12 27 05 de 68 e4 7a 9b b9 |........'..h.z..|
+| 69 |i |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e ef 09 10 a3 0c b7 a7 18 03 12 27 05 de 68 e4 |N..........'..h.|
+| 7a 9b b9 69 |z..i |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 52548 found (nil)
+association_find: TCP port 4436 found 0x342d9a0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a |n.nl:4436.... |
+dissect_ssl3_record found association 0x342d9a0
+
+dissect_ssl enter frame #41 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| dd 76 6d d3 37 22 56 3b 8d e8 d7 8a d0 8d e8 d4 |.vm.7"V;........|
+| a6 9b b1 dd 3f 5f cf 57 37 84 23 1f da 94 d7 b8 |....?_.W7.#.....|
+| aa 25 8e 2b cf a4 58 5a 15 9c de dc 39 78 c6 c8 |.%.+..XZ....9x..|
+| 43 1b a8 2d 41 8d 42 1f 19 e1 da 12 e8 82 2d e1 |C..-A.B.......-.|
+| b6 c3 25 5e c4 55 3b 3f d3 4e 07 10 7e bb df 5d |..%^.U;?.N..~..]|
+| 69 70 5e 5a ed 24 92 e4 9e e3 2f 75 ac 6d 44 26 |ip^Z.$..../u.mD&|
+| f2 f0 95 fc 5a f8 ca 96 d7 11 7e 93 eb 23 1d 7a |....Z.....~..#.z|
+| b1 20 12 8e c6 13 5e b9 11 b0 ea 22 67 58 2c 04 |. ....^...."gX,.|
+| 09 07 3b 27 c6 c1 06 0e 89 93 c1 a9 2e af ca 3d |..;'...........=|
+| dc ee 57 82 a1 fd 71 33 07 3a 4a fb d0 88 1f 65 |..W...q3.:J....e|
+| 45 8c 62 b3 c1 5e 50 37 24 12 4e e7 59 a8 8e 23 |E.b..^P7$.N.Y..#|
+| c8 b8 37 01 43 7a f6 a9 c8 c7 0f aa b5 f9 f9 e6 |..7.Cz..........|
+| a7 65 b5 e7 bb 58 79 12 b1 07 08 df ee c1 52 96 |.e...Xy.......R.|
+| 3a af a3 c3 42 9f fd 0b 00 5b fc 4e 9b 36 41 15 |:...B....[.N.6A.|
+| bf d6 15 1e bf d3 bc 17 d2 e6 cb 50 2a 3e 14 1d |...........P*>..|
+| c2 f3 17 f7 24 52 a7 e5 34 fc 60 d5 6d dd 4f 14 |....$R..4.`.m.O.|
+| 59 cc 1b 0f f1 56 b1 0c 86 d6 8e 87 86 11 03 25 |Y....V.........%|
+| 82 92 c5 4a 93 cc 21 d4 d0 19 30 87 89 4c 43 26 |...J..!...0..LC&|
+| 95 3d 7e 3e c9 55 f7 51 f4 53 44 68 07 73 d2 91 |.=~>.U.Q.SDh.s..|
+| 98 c3 6a 70 eb dc ba 10 69 a6 5d 67 8a 94 8e 4b |..jp....i.]g...K|
+| eb 5c ff 7d 42 5b a3 e6 e2 ca bd 93 ee c4 63 86 |.\.}B[........c.|
+| 54 c7 32 94 38 72 e2 74 13 d6 af 28 df 08 a8 b3 |T.2.8r.t...(....|
+| 4c c2 ae 34 65 c5 4d 57 82 84 79 ed a4 73 ec 70 |L..4e.MW..y..s.p|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d9 c6 84 44 |nl'</script>...D|
+| d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d bf e3 39 c6 |..j.RM. .-.-..9.|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d9 c6 84 44 d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d |...D..j.RM. .-.-|
+| bf e3 39 c6 |..9. |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4436 found 0x342d9a0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x342d9a0
+
+dissect_ssl enter frame #42 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| c3 a9 02 80 e9 7a a0 63 1f a4 c7 42 9e c7 dc 1f |.....z.c...B....|
+| d5 55 d1 72 c5 f9 |.U.r.. |
+Plaintext[22]:
+| 01 00 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 |...d...F.....].V|
+| d0 da 1c 60 1c 1c |...`.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 d0 da |.d...F.....].V..|
+| 1c 60 1c 1c |.`.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #44 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 5b d4 68 03 7d 40 b8 58 7d ab 4d 7c f6 23 5a e4 |[.h.}@.X}.M|.#Z.|
+| 6e e1 65 3d d7 39 |n.e=.9 |
+Plaintext[22]:
+| 01 00 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e |..k.%%..k....`.N|
+| 77 1d 22 f9 26 74 |w.".&t |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e 77 1d |k.%%..k....`.Nw.|
+| 22 f9 26 74 |".&t |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #49 (first time)
+ssl_session_init: initializing ptr 0x7facc3816d50 size 688
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 43026 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4437
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #51 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V|
+| f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.|
+| 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.|
+| 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. |
+hash out[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+PRF out[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+key expansion[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC|
+| 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.|
+| e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....|
+| 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.|
+| 0e 56 49 f3 e4 0d 3f 05 |.VI...?. |
+hash out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+PRF out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 18 80 94 6b 52 |...kR |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+| 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....|
+PRF out[32]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+| 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 9f e0 4c dc 83 |..L.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+| 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....|
+PRF out[32]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+| 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....|
+Client MAC key[20]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 |...G |
+Server MAC key[20]:
+| 0d f7 7c aa cf a0 16 1b e7 db af 5c d5 2e 93 4b |..|........\...K|
+| 06 19 5b 82 |..[. |
+Client Write key[16]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+Server Write key[16]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+Client Write IV[8]:
+| fd 78 18 71 b0 eb fe a5 |.x.q.... |
+Server Write IV[8]:
+| c0 3c 36 49 53 84 f8 e2 |.<6IS... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #53 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8...
+looking for RSA pre-master79a1d2e1fa7136af7a5de4145176273ffdbedd17620baa6d...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0e b9 e2 59 80 8e 59 22 37 ec 51 b4 96 7b 67 ef |...Y..Y"7.Q..{g.|
+| 3b 18 f9 48 c1 b4 0d 7f 78 e3 70 15 49 4c 99 d9 |;..H....x.p.IL..|
+| 51 09 01 5c 42 ee 03 6d d5 9f 0a c4 5b 16 79 d8 |Q..\B..m....[.y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V|
+| f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.|
+| 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.|
+| 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. |
+hash out[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+PRF out[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+key expansion[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC|
+| 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.|
+| e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....|
+| 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.|
+| 0e 56 49 f3 e4 0d 3f 05 |.VI...?. |
+hash out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+PRF out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 73 03 5d 6b 6d |s.]km |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+| 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F|
+PRF out[32]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+| 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 4d 3d 4f 82 10 |M=O.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+| 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....|
+PRF out[32]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+| 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....|
+Client MAC key[20]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 |...& |
+Server MAC key[20]:
+| ff 51 b2 15 12 44 b2 ea 56 96 32 4f f4 1d 64 80 |.Q...D..V.2O..d.|
+| 18 30 43 d7 |.0C. |
+Client Write key[16]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+Server Write key[16]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+Client Write IV[8]:
+| fd 78 18 71 b0 eb fe a5 |.x.q.... |
+Server Write IV[8]:
+| c0 3c 36 49 53 84 f8 e2 |.<6IS... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_handshake can't generate keyring material
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 74 offset 86 length 10589566 bytes, remaining 134
+
+dissect_ssl enter frame #54 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 215 offset 186 length 3870598 bytes, remaining 234
+
+dissect_ssl enter frame #55 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 43026 found (nil)
+association_find: TCP port 4437 found 0x2defbd0
+
+dissect_ssl enter frame #56 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 4437 found 0x2defbd0
+
+dissect_ssl enter frame #57 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #59 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #64 (first time)
+ssl_session_init: initializing ptr 0x7facc3818bb0 size 688
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53104 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4438
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #66 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...|
+| a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.|
+| 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.|
+| ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s |
+hash out[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+PRF out[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+key expansion[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+Client MAC key[20]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 |0/.I |
+Server MAC key[20]:
+| c1 fd 09 90 43 b5 cc fc 7d e9 49 da 7c 52 cc 2c |....C...}.I.|R.,|
+| 1d 7a 08 be |.z.. |
+Client Write key[16]:
+| 1d 78 c1 3b d8 0b 4a da 1f 99 04 f8 bb f8 77 b9 |.x.;..J.......w.|
+Server Write key[16]:
+| e4 44 6c 9e fc 09 63 83 54 c7 fa 1e 77 7a a1 3f |.Dl...c.T...wz.?|
+Client Write IV[8]:
+| 8b 79 54 db 51 41 6b 8e |.yT.QAk. |
+Server Write IV[8]:
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #68 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc...
+looking for RSA pre-master1e816a2993b66faaadfc0adb44c121991b995cb2f6a087fd...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...|
+| a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.|
+| 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.|
+| ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s |
+hash out[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+PRF out[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+key expansion[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+Client MAC key[20]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 |.... |
+Server MAC key[20]:
+| a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f e2 11 0c b2 |..:.....\U......|
+| 0a cb 9f 18 |.... |
+Client Write key[16]:
+| 0a cb 83 a3 c8 85 12 10 a9 bc 14 c6 87 7f a0 04 |................|
+Server Write key[16]:
+| 86 5f d1 b0 90 d2 4a a0 b3 4f 05 eb 82 60 7c cc |._....J..O...`|.|
+Client Write IV[8]:
+| 08 40 48 fb 65 45 97 d5 |.@H.eE.. |
+Server Write IV[8]:
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 90 67 7f e3 85 ed c9 ce b8 59 1d 0e dd 63 72 c7 |.g.......Y...cr.|
+| dc 2c 7f b3 12 f5 35 3f e1 6e c9 86 1f c5 f9 f3 |.,....5?.n......|
+| 6d dc 27 9a 09 0b 33 6b 1a 7c d4 c8 c9 20 fb e3 |m.'...3k.|... ..|
+Plaintext[48]:
+| 23 d6 42 31 8c 7b 61 dd 14 00 00 0c fb 18 0a bd |#.B1.{a.........|
+| 93 02 8d 0d 90 9f 15 3e af c7 ad a0 87 09 fd c5 |.......>........|
+| 06 14 d2 0f ef 6d 65 7f d9 95 cc 08 03 03 03 03 |.....me.........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| af c7 ad a0 87 09 fd c5 06 14 d2 0f ef 6d 65 7f |.............me.|
+| d9 95 cc 08 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #69 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d3 c0 58 c5 c6 54 86 69 26 a1 05 7b a0 51 56 27 |..X..T.i&..{.QV'|
+| 04 87 d5 d3 a1 aa 2a 0c b4 ff 67 18 5c d6 6c 7a |......*...g.\.lz|
+| 51 5e b2 ca 39 16 97 83 0f 7d 53 6b ce 1d f9 0c |Q^..9....}Sk....|
+Plaintext[48]:
+| 4c 1e 65 ed 4e 48 04 aa 14 00 00 0c 34 18 13 9c |L.e.NH......4...|
+| a0 66 7e c4 d8 16 e1 99 83 f4 97 23 d3 ab 38 ee |.f~........#..8.|
+| 48 cf 03 c3 fe 7a 83 45 fc 8e 76 93 03 03 03 03 |H....z.E..v.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 83 f4 97 23 d3 ab 38 ee 48 cf 03 c3 fe 7a 83 45 |...#..8.H....z.E|
+| fc 8e 76 93 |..v. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #70 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 35 ac 8b 9f 80 f7 30 f4 b4 b9 f5 76 f4 d9 1b 8c |5.....0....v....|
+| 0d e2 28 53 7d 25 da 5a 67 97 68 e2 25 fb d6 1c |..(S}%.Zg.h.%...|
+| a0 65 e1 8e 09 be af d4 83 56 7e 64 75 a6 01 95 |.e.......V~du...|
+| 77 aa a9 5b b3 5f 5b b4 fa 49 e8 75 17 db 93 24 |w..[._[..I.u...$|
+| ae 54 5f 7d bb ae 0a 71 ef 99 08 51 3f e8 7e b3 |.T_}...q...Q?.~.|
+| a7 4b 50 96 00 fe 30 ba a5 65 e9 c0 5c 73 30 5e |.KP...0..e..\s0^|
+Plaintext[96]:
+| 38 2c d3 47 db 0c 21 dc 47 45 54 20 2f 20 48 54 |8,.G..!.GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 69 64 |TP/1.1..Host: id|
+| 65 61 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c |ea-cbc-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 33 38 0d 0a 0d 0a 37 97 29 df 25 2d |l:4438....7.).%-|
+| 1b 20 23 1a 1f 82 38 b3 60 3a fc 86 56 bf 01 01 |. #...8.`:..V...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 18 e2 ff 6a ca cb df 36 19 d5 8b 05 26 56 5e 1e |...j...6....&V^.|
+| fb 71 bc 39 |.q.9 |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53104 found (nil)
+association_find: TCP port 4438 found 0x3425920
+
+dissect_ssl enter frame #71 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| a1 45 b9 97 64 d0 47 d9 9b c3 1c 2f da 94 38 67 |.E..d.G..../..8g|
+| fc 9d cb 2a f7 37 7d ae ca f8 f6 d4 ca bd 8d fe |...*.7}.........|
+| 5a fb 12 e4 04 95 ec d7 43 85 d6 5f 2d bb 01 b4 |Z.......C.._-...|
+| 3a 37 de a1 11 d4 46 d6 3d 12 06 44 f6 c7 95 95 |:7....F.=..D....|
+| 18 52 45 0a d6 6f 64 a6 3b 99 92 14 01 7d 83 1d |.RE..od.;....}..|
+| 13 65 5b ce 97 68 00 33 fd b1 16 38 5f a0 41 d5 |.e[..h.3...8_.A.|
+| 4c 30 57 4f 42 94 13 5f ca c8 6b ba 2e f6 a8 16 |L0WOB.._..k.....|
+| c9 59 8b 83 cd ff 6e b2 6a d8 d3 84 98 c5 32 62 |.Y....n.j.....2b|
+| 6c 31 4f f3 b9 40 4f 89 89 36 45 76 8e 58 c4 ed |l1O..@O..6Ev.X..|
+| ec ea 15 0e 52 24 24 c2 2c 35 85 c2 31 2d f9 9e |....R$$.,5..1-..|
+| 91 08 19 3f 3c 5c 5b 78 b3 ec 6f 01 b4 28 b4 ee |...?<\[x..o..(..|
+| ff 07 e5 53 66 17 d9 69 74 fe f8 23 24 e6 8e 97 |...Sf..it..#$...|
+| b5 9d b5 d7 a2 ec 43 eb d9 2b 19 2f f5 45 a5 13 |......C..+./.E..|
+| 3d 53 86 c2 47 fd 02 ca c0 5c d2 84 fb 93 58 b4 |=S..G....\....X.|
+| 39 34 31 50 b6 47 1d 65 d0 4f b5 41 6a 31 c6 6a |941P.G.e.O.Aj1.j|
+| 01 87 e5 23 a1 fe 62 cf 90 60 bf 60 44 e7 b1 31 |...#..b..`.`D..1|
+| b8 07 00 c4 7f 0d 80 9f d2 70 f5 52 2f 8d ad 9e |.........p.R/...|
+| ab e6 dc 66 b9 97 92 f1 4d 0b bb ec 74 ad 11 a6 |...f....M...t...|
+| b4 15 af 2e 7d 81 22 e5 12 57 ec 5b 9b 39 0d 81 |....}."..W.[.9..|
+| 9c ff b1 81 9e fb 35 6a 7d 48 75 49 77 1a b9 b4 |......5j}HuIw...|
+| 2b 08 30 cb 8c 0b a7 95 53 52 4e c5 c3 b7 0d 91 |+.0.....SRN.....|
+| df 15 dd 5d 83 44 34 f4 81 6c fd 05 7a 9b 7c 98 |...].D4..l..z.|.|
+| c9 49 4f 03 73 58 5f 03 f2 a9 da 64 85 eb 9f 0a |.IO.sX_....d....|
+| c7 13 0a 93 c7 66 c7 f3 d6 0f a6 f4 3a 2d 74 08 |.....f......:-t.|
+Plaintext[384]:
+| ae 8e 99 76 d9 61 ff 9b 48 54 54 50 2f 31 2e 31 |...v.a..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 37 |che....0x00,0x07|
+| 20 2d 20 49 44 45 41 2d 43 42 43 2d 53 48 41 20 | - IDEA-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 49 44 45 41 28 31 32 |RSA Enc=IDEA(12|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 84 cb 99 cb 63 c7 43 f1 9d 65 57 e6 |ipt>....c.C..eW.|
+| f9 d7 5b 9b a0 83 d5 c7 07 07 07 07 07 07 07 07 |..[.............|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 7d 45 11 65 2d 37 42 16 78 64 1b 34 d5 d5 9a |.}E.e-7B.xd.4...|
+| 35 e8 2f 09 |5./. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4438 found 0x3425920
+
+dissect_ssl enter frame #72 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d3 1b 64 b4 30 6e 52 69 a1 2c ab 4b e5 73 dc ab |..d.0nRi.,.K.s..|
+| a2 d6 68 81 e9 f3 43 e1 f9 d0 ef be 05 1c b7 2b |..h...C........+|
+Plaintext[32]:
+| 65 12 ec 15 a5 91 75 fd 01 00 49 03 75 0e 63 6c |e.....u...I.u.cl|
+| 16 e4 09 2a 3b 1c bb 02 58 20 7b 2a 6d 6f 01 01 |...*;...X {*mo..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 49 03 75 0e 63 6c 16 e4 09 2a 3b 1c bb 02 58 20 |I.u.cl...*;...X |
+| 7b 2a 6d 6f |{*mo |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #74 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 30 1a d1 69 69 23 95 42 88 f6 84 65 d7 7e cb da |0..ii#.B...e.~..|
+| 6e 01 48 45 9b d2 31 33 20 dd 4f e3 4e e8 87 35 |n.HE..13 .O.N..5|
+Plaintext[32]:
+| 72 1a 1f 8f 05 fb b5 47 01 00 e1 1f 21 eb 91 b4 |r......G....!...|
+| 62 ca b2 10 9b c5 0a 19 10 6b 61 9e c8 b3 01 01 |b........ka.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 1f 21 eb 91 b4 62 ca b2 10 9b c5 0a 19 10 6b |..!...b........k|
+| 61 9e c8 b3 |a... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #79 (first time)
+ssl_session_init: initializing ptr 0x7facc381b170 size 688
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52165 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4439
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #81 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....|
+| 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.|
+| 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.|
+| 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... |
+hash out[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+PRF out[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+key expansion[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...|
+| 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.|
+| df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.|
+| 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.|
+| 0e 35 d8 dc 65 e4 c0 07 |.5..e... |
+hash out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+PRF out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 2d 43 ce 68 92 |-C.h. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.|
+| aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...|
+PRF out[32]:
+| 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.|
+| aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 13 35 a1 ad |..5.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..|
+| 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e|
+PRF out[32]:
+| 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..|
+| 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e|
+Client MAC key[20]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc |..Z. |
+Server MAC key[20]:
+| bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 42 d6 9d 5a |.../......k.B..Z|
+| 3e 5e e2 02 |>^.. |
+Client Write key[8]:
+| 2f e0 62 90 e6 dc 26 9e |/.b...&. |
+Server Write key[8]:
+| 1d f8 a0 57 33 05 9d 5a |...W3..Z |
+Client Write IV[8]:
+| 1a 56 15 98 62 8c 1a c5 |.V..b... |
+Server Write IV[8]:
+| f6 02 d4 da b4 c4 b5 bb |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #83 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309f...
+looking for RSA pre-mastera62989ead4a8a5e58bf2f6a2f811703a3d65165916bb8dda...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....|
+| 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.|
+| 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.|
+| 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... |
+hash out[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+PRF out[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+key expansion[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...|
+| 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.|
+| df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.|
+| 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.|
+| 0e 35 d8 dc 65 e4 c0 07 |.5..e... |
+hash out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+PRF out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| a1 de 58 84 98 |..X.. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......|
+| 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..|
+PRF out[32]:
+| ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......|
+| 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| f9 5d b0 8c 6f |.]..o |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.|
+| 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..|
+PRF out[32]:
+| 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.|
+| 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..|
+Client MAC key[20]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 |.%|. |
+Server MAC key[20]:
+| fb 2f c2 20 9b 0b ed bd 10 38 6e eb 49 5b 72 32 |./. .....8n.I[r2|
+| ce 63 7c 2f |.c|/ |
+Client Write key[8]:
+| ef 0d 2b 13 ce 78 93 43 |..+..x.C |
+Server Write key[8]:
+| 99 f4 36 14 b1 15 c3 94 |..6..... |
+Client Write IV[8]:
+| 1a 56 15 98 62 8c 1a c5 |.V..b... |
+Server Write IV[8]:
+| f6 02 d4 da b4 c4 b5 bb |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9e 2f 76 d1 2f 2f b9 3b dd 2d bf c9 71 ea 86 29 |./v.//.;.-..q..)|
+| a4 2d 4c 2b 75 8c 0e 9e 10 49 1e bb 60 8c 2b 04 |.-L+u....I..`.+.|
+| 1c 71 b9 ff 1f fe 98 86 ea 50 7f 05 8a 01 33 fb |.q.......P....3.|
+Plaintext[48]:
+| 24 51 a1 43 c0 ec a3 1a 14 00 00 0c aa 2a 3d 27 |$Q.C.........*='|
+| 66 61 97 a7 58 37 13 b6 36 ab dc c7 72 bd a3 8a |fa..X7..6...r...|
+| cf fc 79 75 9d 69 52 63 ac 99 01 91 03 03 03 03 |..yu.iRc........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 36 ab dc c7 72 bd a3 8a cf fc 79 75 9d 69 52 63 |6...r.....yu.iRc|
+| ac 99 01 91 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #84 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 02 97 a5 f6 a9 60 b1 e6 25 f6 af 28 a0 00 5e 4e |.....`..%..(..^N|
+| d8 e1 3e 4b 6e bd 2b f4 88 6e 71 34 a9 38 16 b2 |..>Kn.+..nq4.8..|
+| 12 a4 a0 1e 74 46 5c 28 fc 04 9a 2f 88 82 ae 01 |....tF\(.../....|
+Plaintext[48]:
+| f2 99 b1 0e ac c0 45 f1 14 00 00 0c 03 4e 36 17 |......E......N6.|
+| 0b 12 6b f2 c1 ab 9c 9e 4f 12 5a a2 8c a1 e5 c5 |..k.....O.Z.....|
+| ed f5 77 d2 51 0d 10 e1 6f cc dd 29 03 03 03 03 |..w.Q...o..)....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4f 12 5a a2 8c a1 e5 c5 ed f5 77 d2 51 0d 10 e1 |O.Z.......w.Q...|
+| 6f cc dd 29 |o..) |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #85 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| d5 df 46 7f 5e 0e ee 94 fe d8 89 05 b4 fd cd c3 |..F.^...........|
+| c6 b3 a6 60 51 ce c2 42 9f 26 23 d6 c9 6d 9e d2 |...`Q..B.&#..m..|
+| 96 c2 3a 5d f9 68 a4 64 1d 94 cc 0a 9f c7 43 f6 |..:].h.d......C.|
+| b8 e5 f1 cf 3d 14 22 b6 c9 5d 26 02 32 4a 6a 29 |....=."..]&.2Jj)|
+| f4 66 ca 68 35 19 7a 67 fb 94 70 d9 9b 58 67 6c |.f.h5.zg..p..Xgl|
+| 41 dd 04 e0 2d 7f 99 e9 29 37 6f 0d 38 3e b7 83 |A...-...)7o.8>..|
+| 54 eb e9 6e 3a ed 43 25 |T..n:.C% |
+Plaintext[104]:
+| a4 89 ea 43 1b eb ed 86 47 45 54 20 2f 20 48 54 |...C....GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 78 |TP/1.1..Host: ex|
+| 70 2d 64 65 73 2d 63 62 63 2d 73 68 61 2e 6c 6f |p-des-cbc-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 39 0d 0a 0d 0a 93 00 b8 |n.nl:4439.......|
+| 41 d0 ae 0c 83 0a a8 b2 d8 14 3f ac b9 00 71 a9 |A.........?...q.|
+| 11 06 06 06 06 06 06 06 |........ |
+ssl_decrypt_record found padding 6 final len 97
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 93 df f4 91 22 37 94 81 50 48 8a d4 88 08 65 e5 |...."7..PH....e.|
+| ef 4b 2a e1 |.K*. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52165 found (nil)
+association_find: TCP port 4439 found 0x342cfb0
+
+dissect_ssl enter frame #86 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| d0 c7 ac f3 05 4f c3 4e ac 40 c5 57 06 0b 60 bf |.....O.N.@.W..`.|
+| 4c c7 82 3e 85 78 50 02 81 e9 18 cb 92 dd 4e 46 |L..>.xP.......NF|
+| 51 5c a7 59 53 94 59 cd a9 d8 90 fe 3f 7f 0d 7a |Q\.YS.Y.....?..z|
+| ab bf ec a3 e3 20 f7 85 35 04 60 7f 52 42 0d 4a |..... ..5.`.RB.J|
+| 63 51 d2 8d 15 b2 88 8a 9b 7d d7 3d 6d 56 6c 9c |cQ.......}.=mVl.|
+| 75 6b 85 12 61 fc 39 a7 29 d8 fd 77 aa ee e3 4e |uk..a.9.)..w...N|
+| ee a2 1c 19 35 9f 80 c6 a6 fe 08 93 ed ff 89 71 |....5..........q|
+| 13 3c 70 84 5b 44 2c d0 64 a1 26 77 fa 97 0f 49 |.<p.[D,.d.&w...I|
+| 2b 23 c1 f9 21 2f 93 58 23 18 78 1d aa ea b5 ee |+#..!/.X#.x.....|
+| 7e 47 e0 dd b5 85 fe b8 b4 6b 5f 29 9b 32 85 d7 |~G.......k_).2..|
+| da 74 da ff ad 66 20 02 bd 6e a1 11 d1 41 43 35 |.t...f ..n...AC5|
+| 4f 8b 13 65 93 d2 a8 a1 93 1b d2 ed 73 d2 55 13 |O..e........s.U.|
+| e0 52 7d 0b 3b ef e0 0f 52 28 8f a6 23 d5 a3 6d |.R}.;...R(..#..m|
+| e0 30 b4 6e 68 7e 59 02 df 23 b7 69 51 52 66 7e |.0.nh~Y..#.iQRf~|
+| f3 79 d0 98 ab 2d ec 95 3c 20 16 59 51 bb 6b 59 |.y...-..< .YQ.kY|
+| c3 1f e2 a8 ca b6 f3 69 33 48 5e 2b 17 f9 7f e4 |.......i3H^+....|
+| 2b cb 3c 99 25 5c 10 10 44 93 50 e0 4a a4 3b 25 |+.<.%\..D.P.J.;%|
+| 51 ba 88 08 f8 de 64 e4 62 7f 53 e2 b6 5b 30 fc |Q.....d.b.S..[0.|
+| 38 1b 39 f1 2b 48 a7 b2 c1 37 42 f9 1b b2 24 63 |8.9.+H...7B...$c|
+| 60 6c 3c 42 6d 40 c0 30 75 ec 0f 48 c1 bf 0b 76 |`l<Bm@.0u..H...v|
+| c1 41 c2 7a 8b 06 6d 7b 83 a8 dc 8d f0 43 45 40 |.A.z..m{.....CE@|
+| 00 44 e4 74 05 ed c5 96 38 e1 a6 b9 58 04 d4 dd |.D.t....8...X...|
+| da 79 1b 38 70 c7 d3 da 90 ea 19 da 3a c4 78 ee |.y.8p.......:.x.|
+| aa dd 52 5b ce 98 a8 a6 4c bc f8 83 78 57 f5 c1 |..R[....L...xW..|
+Plaintext[384]:
+| fd 3e c1 46 cb 01 dd bd 48 54 54 50 2f 31 2e 31 |.>.F....HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 38 0d |ent-Length: 148.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 38 |che....0x00,0x08|
+| 20 2d 20 45 58 50 2d 44 45 53 2d 43 42 43 2d 53 | - EXP-DES-CBC-S|
+| 48 41 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 |HA SSLv3|
+| 20 4b 78 3d 52 53 41 28 35 31 32 29 20 41 75 3d | Kx=RSA(512) Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 34 30 29 |RSA Enc=DES(40)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 20 65 78 70 6f | Mac=SHA1 expo|
+| 72 74 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |rt<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 02 d9 be 01 69 |l'</script>....i|
+| 26 10 0f 06 e2 8f e2 b9 d9 f0 34 de 06 15 c2 00 |&.........4.....|
+ssl_decrypt_record found padding 0 final len 383
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 bc 22 86 7e 5f f8 3a 84 6a 1b 8b b5 0d 62 c0 |..".~_.:.j....b.|
+| ca c1 7f 40 |...@ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4439 found 0x342cfb0
+
+dissect_ssl enter frame #87 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 21 25 a2 6d 98 e3 24 3b 53 62 1c 7a d0 f7 6d f0 |!%.m..$;Sb.z..m.|
+| 73 1c d5 8c 19 1d 00 1c ef 69 90 e0 6d 24 8f a3 |s........i..m$..|
+Plaintext[32]:
+| 03 a5 dd be a0 be ef 4a 01 00 2a cf 2c 48 90 13 |.......J..*.,H..|
+| 7c ea cd 01 d7 6c dd 23 a8 a3 bd 4d 60 9c 01 01 ||....l.#...M`...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2a cf 2c 48 90 13 7c ea cd 01 d7 6c dd 23 a8 a3 |*.,H..|....l.#..|
+| bd 4d 60 9c |.M`. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #89 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 37 7e 17 a7 c4 96 ff d7 75 c2 29 a6 97 50 2e 9c |7~......u.)..P..|
+| d4 40 b7 6b f2 14 9c 56 51 6e 3e b9 b3 c5 6f 89 |.@.k...VQn>...o.|
+Plaintext[32]:
+| 57 93 1e c1 ad a6 90 6b 01 00 51 df 8b 46 02 5c |W......k..Q..F.\|
+| f3 bd cd 30 44 eb d7 cb c5 ee 66 bb 74 d8 01 01 |...0D.....f.t...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 51 df 8b 46 02 5c f3 bd cd 30 44 eb d7 cb c5 ee |Q..F.\...0D.....|
+| 66 bb 74 d8 |f.t. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #94 (first time)
+ssl_session_init: initializing ptr 0x7facc381d630 size 688
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50147 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4440
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #96 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....|
+| 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.|
+| 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f|
+| f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... |
+hash out[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+PRF out[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+key expansion[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+Client MAC key[20]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f |^C.o |
+Server MAC key[20]:
+| bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 f2 32 56 fb |..p.._~9..%`.2V.|
+| 9f a4 9a 8b |.... |
+Client Write key[8]:
+| 9f 58 38 0d 59 c0 86 12 |.X8.Y... |
+Server Write key[8]:
+| 0c 82 76 fe ec 53 37 c9 |..v..S7. |
+Client Write IV[8]:
+| c6 61 03 48 fd 2a ce 40 |.a.H.*.@ |
+Server Write IV[8]:
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #98 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94...
+looking for RSA pre-master113e309073f08d54ca50f560cbcc67a69298e5c229d6ee4c...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....|
+| 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.|
+| 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f|
+| f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... |
+hash out[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+PRF out[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+key expansion[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+Client MAC key[20]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 |.Y.. |
+Server MAC key[20]:
+| 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 3d 0d 36 ac |..nh.=~..,..=.6.|
+| fe 16 83 d5 |.... |
+Client Write key[8]:
+| 82 74 79 3f ec b5 47 7d |.ty?..G} |
+Server Write key[8]:
+| 67 8a 93 62 1b ca fd 45 |g..b...E |
+Client Write IV[8]:
+| 8c 8a af b4 c2 61 12 81 |.....a.. |
+Server Write IV[8]:
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4d 49 26 30 9f 76 b9 65 f2 de d9 fe b2 a4 a1 ec |MI&0.v.e........|
+| d4 ca 74 ce db 15 60 77 e5 c5 f8 2f 93 57 ae d4 |..t...`w.../.W..|
+| 12 d6 53 d0 40 e5 8f 5f 3b b0 2e 0c 57 b1 ef 17 |..S.@.._;...W...|
+Plaintext[48]:
+| b2 2d be 6a 6c 68 e3 67 14 00 00 0c 32 36 10 27 |.-.jlh.g....26.'|
+| 45 c2 35 2e e7 fd 99 ef e6 41 49 34 3a c8 68 cc |E.5......AI4:.h.|
+| 39 b6 bc be 20 25 c7 89 e5 7e 74 0a 03 03 03 03 |9... %...~t.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e6 41 49 34 3a c8 68 cc 39 b6 bc be 20 25 c7 89 |.AI4:.h.9... %..|
+| e5 7e 74 0a |.~t. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #99 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c3 ea fd 82 d3 d6 6c e2 00 bb c3 84 1d 48 24 0a |......l......H$.|
+| 6f 2d 02 f4 77 5b 43 ac ab 04 7c 54 bd 2b 81 de |o-..w[C...|T.+..|
+| 76 7c c9 56 a0 35 d1 f6 ff ec ca 85 8c ea 1e e5 |v|.V.5..........|
+Plaintext[48]:
+| dd 05 d3 72 a2 14 09 14 14 00 00 0c ed 76 03 3a |...r.........v.:|
+| a3 69 18 52 fb dc 1b ef 0d 9c 8c bd 6b 84 4f 23 |.i.R........k.O#|
+| 8a c5 cd a6 59 9b 86 57 28 90 0b 02 03 03 03 03 |....Y..W(.......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0d 9c 8c bd 6b 84 4f 23 8a c5 cd a6 59 9b 86 57 |....k.O#....Y..W|
+| 28 90 0b 02 |(... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #100 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 11 db b3 52 2e ad 38 13 bc 11 5d f4 29 5a 5c 06 |...R..8...].)Z\.|
+| a0 a9 08 da 2c 4f d2 19 77 1d 33 f4 75 2d 11 78 |....,O..w.3.u-.x|
+| e1 4f 11 0c a2 fc 38 1d 23 e1 9e af 16 21 37 58 |.O....8.#....!7X|
+| d5 90 60 4b 63 b0 1f 98 07 99 9f 00 29 5e 99 9e |..`Kc.......)^..|
+| b2 e0 1e 6c b5 e1 75 6d c1 0a ed 54 28 a4 c2 ef |...l..um...T(...|
+| 44 ea 12 60 ee 77 fc f8 11 81 07 33 68 6c bf 3b |D..`.w.....3hl.;|
+Plaintext[96]:
+| c5 34 71 10 4f 4f 9c 44 47 45 54 20 2f 20 48 54 |.4q.OO.DGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 30 0d 0a 0d 0a 6e 7d 5e 16 f6 79 c0 |:4440....n}^..y.|
+| ff 31 f9 b3 27 95 a0 f5 10 be bc fe 4b 02 02 02 |.1..'.......K...|
+ssl_decrypt_record found padding 2 final len 93
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7e 6f 9d 97 cf 0d 1d 4a d2 5e f0 23 ec 73 04 f5 |~o.....J.^.#.s..|
+| b8 a0 aa 89 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50147 found (nil)
+association_find: TCP port 4440 found 0x342d040
+
+dissect_ssl enter frame #101 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 20 7a e5 fb 30 5d bf 30 4b 54 b2 d8 7d db db 30 | z..0].0KT..}..0|
+| 49 22 22 28 c7 f5 8e a4 ad 6c b4 5d 0b 69 9f 7c |I""(.....l.].i.||
+| 5a 6a 56 1e 7e 3b 60 20 1c dd 27 e0 14 59 0c 5e |ZjV.~;` ..'..Y.^|
+| e5 c0 07 79 a6 4e a0 35 c1 a9 d5 d3 0c c8 f3 c1 |...y.N.5........|
+| ef 1c 07 f0 36 79 f3 0b 79 ff 7e d3 29 96 85 ac |....6y..y.~.)...|
+| a9 90 50 95 d4 9d 52 ab dc 9a bd c3 4b 7c 6b 55 |..P...R.....K|kU|
+| b2 44 00 91 0a d1 6c 69 d8 c8 1f 49 78 5a f8 b3 |.D....li...IxZ..|
+| 9e 9e 61 e4 86 b5 92 33 7f 14 83 95 41 93 d2 05 |..a....3....A...|
+| 4b a1 0a 05 35 38 5a 37 5d f4 c0 0e b0 1c d0 32 |K...58Z7]......2|
+| e2 9d 10 6d ff c3 8b af c5 18 3f d4 45 6a a8 84 |...m......?.Ej..|
+| 1e a9 ed c8 d1 1f 2b 56 a8 77 e7 75 62 9d 7f ee |......+V.w.ub...|
+| e7 cd 70 2e 92 15 f1 e2 87 b4 bc 13 df 81 fd 30 |..p............0|
+| 4c 02 41 6c 67 e8 be 2f 68 11 de e9 f1 3c 5e fb |L.Alg../h....<^.|
+| 3f ab 3a d0 87 1e b3 39 cb af 07 49 8a 9a 21 04 |?.:....9...I..!.|
+| 6c 23 45 94 a4 b9 ef 31 7b 4c c9 16 0c 6b 4d ad |l#E....1{L...kM.|
+| 3e 9a 08 cc 69 3f aa 05 35 d5 d0 d7 f7 6e 4a 60 |>...i?..5....nJ`|
+| f3 27 67 3d 96 3c 40 42 d1 94 38 00 09 75 47 73 |.'g=.<@B..8..uGs|
+| 14 74 3f 0f bb 60 3f e5 54 69 e9 2c 0d 27 12 fc |.t?..`?.Ti.,.'..|
+| 84 73 65 67 b9 c0 f3 72 d3 c8 70 db 14 8c 77 14 |.seg...r..p...w.|
+| b9 a4 62 9d 9a fb 3f 56 0e 96 6f ff 61 be ff 80 |..b...?V..o.a...|
+| 95 47 c5 a3 9c 5a 73 3c 27 c6 6f f7 15 bd 2f 12 |.G...Zs<'.o.../.|
+| 3d 26 23 42 b5 35 e5 1a 7e 85 21 ea b3 45 2f a6 |=&#B.5..~.!..E/.|
+| 73 06 d6 0d 28 33 82 13 de 53 f8 61 13 09 9f e0 |s...(3...S.a....|
+| 85 8f b7 73 56 e2 ba f4 97 31 45 d9 a2 b8 a6 0f |...sV....1E.....|
+Plaintext[384]:
+| 21 d5 ef cf b8 85 d2 01 48 54 54 50 2f 31 2e 31 |!.......HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 39 |che....0x00,0x09|
+| 20 2d 20 44 45 53 2d 43 42 43 2d 53 48 41 20 20 | - DES-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 67 bb 26 a7 53 68 cb 4d d9 b0 61 14 |ipt>g.&.Sh.M..a.|
+| 08 13 d8 79 3a 36 a2 0a 07 07 07 07 07 07 07 07 |...y:6..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 fa 92 45 d4 13 d8 bb 5e 86 a6 3e 2b ab 10 05 |...E....^..>+...|
+| 66 af 62 d4 |f.b. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4440 found 0x342d040
+
+dissect_ssl enter frame #102 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ca cd 98 23 77 ce f4 50 c2 57 19 9c 6a 94 96 83 |...#w..P.W..j...|
+| da e8 13 d1 6c be f0 4d e4 7e d9 86 d3 d0 00 5b |....l..M.~.....[|
+Plaintext[32]:
+| 6e ab 83 3a 0c 6a 54 72 01 00 7b 75 cf dc 51 f7 |n..:.jTr..{u..Q.|
+| 5f 4a de 1b 15 82 02 fd ce 0e e2 86 e7 eb 01 01 |_J..............|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7b 75 cf dc 51 f7 5f 4a de 1b 15 82 02 fd ce 0e |{u..Q._J........|
+| e2 86 e7 eb |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #104 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d4 57 0a 93 7f ed 1e ca 54 06 8d 5c de 13 74 43 |.W......T..\..tC|
+| 6f 98 56 8f 55 8e 7c cb a0 80 21 38 ce ce f8 b9 |o.V.U.|...!8....|
+Plaintext[32]:
+| f2 89 20 50 3a 5d a2 8a 01 00 6c 47 5d 5a 84 c2 |.. P:]....lG]Z..|
+| 11 a8 4e 93 b7 2f 0e 46 2c 9d 58 91 e2 db 01 01 |..N../.F,.X.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 47 5d 5a 84 c2 11 a8 4e 93 b7 2f 0e 46 2c 9d |lG]Z....N../.F,.|
+| 58 91 e2 db |X... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #109 (first time)
+ssl_session_init: initializing ptr 0x7facc381fbf0 size 688
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55756 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4441
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #111 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..|
+| c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.|
+| 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(|
+| 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K |
+hash out[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+PRF out[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+key expansion[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+Client MAC key[20]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be |..3. |
+Server MAC key[20]:
+| f5 77 31 d2 e3 59 16 50 ad 49 44 c2 d7 ff bf 83 |.w1..Y.P.ID.....|
+| 23 11 02 07 |#... |
+Client Write key[24]:
+| 56 80 49 52 75 8a b0 66 66 5b d7 9e 3a 1a 20 6d |V.IRu..ff[..:. m|
+| 71 5b 66 e7 ed 85 85 05 |q[f..... |
+Server Write key[24]:
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 |q.r.N..3 |
+Client Write IV[8]:
+| 8d 60 74 7d c3 94 cd 02 |.`t}.... |
+Server Write IV[8]:
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #113 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ec...
+looking for RSA pre-master002f09b09d0de0dba351fcefb17adf42995c476d0a2bd37f...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..|
+| c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.|
+| 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(|
+| 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K |
+hash out[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+PRF out[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+key expansion[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+Client MAC key[20]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a |.... |
+Server MAC key[20]:
+| 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 98 44 b6 06 |.!........,..D..|
+| b2 54 66 cb |.Tf. |
+Client Write key[24]:
+| 5f 49 2c 8d 04 b9 bf c1 43 98 17 73 f1 65 a7 86 |_I,.....C..s.e..|
+| dc 5c ad 8d 68 6c a4 de |.\..hl.. |
+Server Write key[24]:
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 |.*...+. |
+Client Write IV[8]:
+| 1b d1 5a 49 1c 45 59 6b |..ZI.EYk |
+Server Write IV[8]:
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 64 d7 01 47 6d 68 ac be 80 ef 6a f6 0b 3e 38 2c |d..Gmh....j..>8,|
+| 2d 5c d7 1d f4 4d cc e3 09 c3 4c f6 5b fe d0 fd |-\...M....L.[...|
+| 9d e9 49 c3 a0 80 56 6c c4 b4 b8 a0 25 e3 00 e0 |..I...Vl....%...|
+Plaintext[48]:
+| 53 a9 17 8a a6 e5 f7 a2 14 00 00 0c 0b 5c 4f c2 |S............\O.|
+| 41 06 37 83 4a 3b 8e af cd 23 af 7a 24 a1 0e 71 |A.7.J;...#.z$..q|
+| 9b d0 6a 0f 9a 5e a3 5c 8c 27 ff 35 03 03 03 03 |..j..^.\.'.5....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 23 af 7a 24 a1 0e 71 9b d0 6a 0f 9a 5e a3 5c |.#.z$..q..j..^.\|
+| 8c 27 ff 35 |.'.5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #114 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 47 5b eb de 90 8a 3d 10 98 da 79 32 f8 f7 fd 75 |G[....=...y2...u|
+| e9 03 0a 06 8d f6 f9 84 c8 ad b5 25 42 4f 10 42 |...........%BO.B|
+| 30 56 21 8e a6 18 bb c9 ef 7d 32 87 c6 e9 c4 b5 |0V!......}2.....|
+Plaintext[48]:
+| c0 f9 b0 90 c3 2d ad 4a 14 00 00 0c 97 aa 11 89 |.....-.J........|
+| 33 79 e3 13 5d 72 87 f0 76 41 81 af 18 ed 8d cd |3y..]r..vA......|
+| 09 9d ac dc 72 fa fc bb 47 13 bf 45 03 03 03 03 |....r...G..E....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 76 41 81 af 18 ed 8d cd 09 9d ac dc 72 fa fc bb |vA..........r...|
+| 47 13 bf 45 |G..E |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #115 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 73 db bd d6 64 e3 d7 0a 0c 4a fb b6 24 c2 2a d4 |s...d....J..$.*.|
+| ca 9a ec 15 0b b0 47 20 2d 76 60 b1 dd 66 45 5c |......G -v`..fE\|
+| 58 f0 07 b7 47 3a 6f a2 45 90 4d fd 30 99 3f 32 |X...G:o.E.M.0.?2|
+| 43 84 88 47 59 57 2e af 6b c4 0f d9 52 18 5e e7 |C..GYW..k...R.^.|
+| ed 4b 97 52 f9 b4 51 4f 8f 3d 5a 68 9d 76 b1 76 |.K.R..QO.=Zh.v.v|
+| 66 16 b4 1e d1 a3 a9 c7 9f 14 33 4e 38 cd c8 6d |f.........3N8..m|
+Plaintext[96]:
+| fd 0c 83 39 38 9b 82 b9 47 45 54 20 2f 20 48 54 |...98...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 31 0d 0a 0d 0a 7d 31 90 11 1e d5 |l:4441....}1....|
+| a6 6e 98 a1 8d 51 2c 1f 9f 47 cd a1 6d d5 01 01 |.n...Q,..G..m...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| af 05 67 d6 7c 43 c7 1b 65 34 9d 67 d4 5e 20 eb |..g.|C..e4.g.^ .|
+| e7 e6 ac 49 |...I |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55756 found (nil)
+association_find: TCP port 4441 found 0x342d0d0
+
+dissect_ssl enter frame #116 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 81 25 d4 59 0f 03 bc 3c ad 17 b0 01 a8 10 56 03 |.%.Y...<......V.|
+| 1e 2c 32 67 45 34 8b f8 66 8c 52 52 51 ed 13 b0 |.,2gE4..f.RRQ...|
+| 23 bc 36 78 3e e4 2d 0d a1 23 be 97 6b 19 6b 14 |#.6x>.-..#..k.k.|
+| 58 da d3 0f 12 17 aa 56 50 c8 aa 5b 7c 6f 2c 7f |X......VP..[|o,.|
+| cd 77 2a d5 a6 93 9e 1e 8f 1a cb 07 67 0d 8b 52 |.w*.........g..R|
+| 90 2a 52 c6 c2 d1 67 80 6a 1d 21 89 ec f1 3e ad |.*R...g.j.!...>.|
+| d8 33 fa 93 a2 b0 de b2 7d af 36 19 a3 6a 3b e5 |.3......}.6..j;.|
+| 51 d9 df 6c 7d 08 eb 92 a5 a9 ca ac 59 aa e4 59 |Q..l}.......Y..Y|
+| 15 63 e7 7f f4 79 b8 59 a5 e8 f6 3c cd c8 1c 60 |.c...y.Y...<...`|
+| 7d 0e ce b0 75 6b 5c cb d3 36 20 ea 0b 6c 6f 1c |}...uk\..6 ..lo.|
+| 63 21 7b 1c 2c 3c 21 c4 da 10 5b c5 eb 83 5f ae |c!{.,<!...[..._.|
+| 89 b7 42 89 0a 2e d5 4b 7b cf 76 af 25 0f c8 7e |..B....K{.v.%..~|
+| c6 ea cc 94 d2 ca d9 00 d4 69 95 f1 25 94 04 76 |.........i..%..v|
+| 05 cd a5 80 9e 59 4d ea 84 ed 1b 63 bc ec 9c e8 |.....YM....c....|
+| 36 30 ea f6 d9 83 8b 9d f2 48 f7 95 9c 2a 76 56 |60.......H...*vV|
+| 6f 7a 32 2e 9b 4f 0e 27 05 2e ad d9 74 d6 29 25 |oz2..O.'....t.)%|
+| 47 71 35 bb 85 eb 84 dc 66 6a c3 81 41 c6 1e 17 |Gq5.....fj..A...|
+| 68 0e 38 3e 39 d1 ea 8c aa 09 8b 09 c4 b8 49 cd |h.8>9.........I.|
+| 28 08 1f 96 61 38 05 e9 a1 06 9c 46 61 6b 08 00 |(...a8.....Fak..|
+| f1 e1 4d 50 e9 7f 9e 27 c4 46 06 3e 0c 7e ff 07 |..MP...'.F.>.~..|
+| 1f f7 c4 4c 24 5f 5f 94 0c 97 de 1a 66 f4 09 9f |...L$__.....f...|
+| 75 14 17 cb a4 3e 61 35 ec e7 8b 63 61 4e bc 96 |u....>a5...caN..|
+| 8e d3 d1 8f 8d 19 f8 f4 cf 7b ec 7a d6 f7 02 45 |.........{.z...E|
+| 1a bc 66 28 6e 45 5c 07 fe dd ee 3a d8 06 8a 0b |..f(nE\....:....|
+Plaintext[384]:
+| d7 87 da 2c b6 ac a8 e6 48 54 54 50 2f 31 2e 31 |...,....HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 41 |che....0x00,0x0A|
+| 20 2d 20 44 45 53 2d 43 42 43 33 2d 53 48 41 20 | - DES-CBC3-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 1c 84 af 4f ea 91 26 ea 0b fb 4c c3 |ipt>...O..&...L.|
+| 9b c9 15 8e 1a 02 2b 6d 07 07 07 07 07 07 07 07 |......+m........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 5d 7a ca 0d 41 2c 16 d2 05 1c 14 d2 fe b5 ff |.]z..A,.........|
+| c9 df da 04 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4441 found 0x342d0d0
+
+dissect_ssl enter frame #117 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2b 1b f6 bf 99 db 13 91 ea a9 e6 70 92 3e 80 d2 |+..........p.>..|
+| 29 be 4e 47 2f 5c bd 57 73 50 c5 af 0c 6d 97 0e |).NG/\.WsP...m..|
+Plaintext[32]:
+| 0e a7 12 62 90 a2 6a c8 01 00 ee 80 00 9b 9c 51 |...b..j........Q|
+| ed a5 c3 5b 34 71 45 b2 b1 9e a2 cf d8 91 01 01 |...[4qE.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 80 00 9b 9c 51 ed a5 c3 5b 34 71 45 b2 b1 9e |.....Q...[4qE...|
+| a2 cf d8 91 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #119 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 58 4f 72 ed 2c 1f 62 60 69 57 1c ad b9 72 0b 3c |XOr.,.b`iW...r.<|
+| 6e 15 79 a3 b9 85 e2 0e 0d 6c 8a a3 aa e7 07 3c |n.y......l.....<|
+Plaintext[32]:
+| e1 ef 85 ff bb 67 17 3e 01 00 74 b7 63 97 30 e2 |.....g.>..t.c.0.|
+| 31 6a e0 09 a2 b4 95 b8 d0 e5 aa 60 ef 72 01 01 |1j.........`.r..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 b7 63 97 30 e2 31 6a e0 09 a2 b4 95 b8 d0 e5 |t.c.0.1j........|
+| aa 60 ef 72 |.`.r |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #124 (first time)
+ssl_session_init: initializing ptr 0x7facc3822170 size 688
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47475 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4443
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #126 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..|
+| 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.|
+| 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....|
+| 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ |
+hash out[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+PRF out[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+key expansion[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+Client MAC key[20]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d |/.Dm |
+Server MAC key[20]:
+| 3a 09 14 d8 cc 41 5b 87 84 18 51 0d fa 6b 1a c1 |:....A[...Q..k..|
+| d2 dd ee 99 |.... |
+Client Write key[8]:
+| ae 7e 55 f1 46 cc 7f 2f |.~U.F../ |
+Server Write key[8]:
+| a6 48 c3 fe e6 7c 70 ed |.H...|p. |
+Client Write IV[8]:
+| 2e 80 8f 37 fc 81 8c 65 |...7...e |
+Server Write IV[8]:
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #128 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea04096...
+looking for RSA pre-master0080b8603544edfde42c437eb40569d8924b670069534998...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..|
+| 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.|
+| 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....|
+| 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ |
+hash out[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+PRF out[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+key expansion[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+Client MAC key[20]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 |D... |
+Server MAC key[20]:
+| a9 07 e8 e8 db d7 87 10 a5 c3 72 08 28 4d b0 4c |..........r.(M.L|
+| 65 40 0d a2 |e@.. |
+Client Write key[8]:
+| c0 9e 03 fc 60 02 8f 26 |....`..& |
+Server Write key[8]:
+| 3c 51 cd a9 2f 0d 6f 76 |<Q../.ov |
+Client Write IV[8]:
+| 1d bb e0 92 17 48 aa 0e |.....H.. |
+Server Write IV[8]:
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e7 7a 13 54 dd f2 f6 fa 66 95 fa 78 b6 35 fb 7b |.z.T....f..x.5.{|
+| c8 0b 02 69 09 55 e2 de d9 dc 78 3b b1 d4 73 fd |...i.U....x;..s.|
+| 1b 39 10 ec 70 c0 07 7d fa 65 64 f7 cd e3 32 1b |.9..p..}.ed...2.|
+Plaintext[48]:
+| f8 ba 66 a0 c5 f2 aa 27 14 00 00 0c a1 94 7b 7c |..f....'......{||
+| 50 b6 db d7 23 b3 d5 e6 5d 50 13 15 c2 c6 a0 13 |P...#...]P......|
+| 1f f1 ad 62 02 63 1c 4d 62 69 01 48 03 03 03 03 |...b.c.Mbi.H....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 50 13 15 c2 c6 a0 13 1f f1 ad 62 02 63 1c 4d |]P.........b.c.M|
+| 62 69 01 48 |bi.H |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #129 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d5 f9 70 e3 57 3f 97 6a c0 84 4c 1d 32 e1 71 47 |..p.W?.j..L.2.qG|
+| 38 1d 6e 43 a1 89 0f 85 51 f6 62 d1 55 ed a8 0e |8.nC....Q.b.U...|
+| a4 6d d0 50 54 d0 05 86 5e e2 a8 78 61 33 50 99 |.m.PT...^..xa3P.|
+Plaintext[48]:
+| 29 0f c6 15 ba 5a a0 aa 14 00 00 0c 6a 86 2b bf |)....Z......j.+.|
+| a5 7a f7 b5 15 a8 22 95 cd c2 cb fd 3b 7d 57 ff |.z....".....;}W.|
+| 45 f0 43 46 5c 0a 12 32 a9 05 a7 b6 03 03 03 03 |E.CF\..2........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd c2 cb fd 3b 7d 57 ff 45 f0 43 46 5c 0a 12 32 |....;}W.E.CF\..2|
+| a9 05 a7 b6 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #130 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 95 c6 8f 5c cb a6 bb c8 e4 9a a7 a1 be a7 99 46 |...\...........F|
+| de 1c 4c e0 39 cf 77 4d e7 ed ed 6f 3c a1 48 b7 |..L.9.wM...o<.H.|
+| bd d8 50 3c 3e 5d a0 b0 26 04 e2 da c4 d5 50 95 |..P<>]..&.....P.|
+| 83 f2 ba 23 37 68 7d 72 7f 7e d0 48 a8 3f 6b 0e |...#7h}r.~.H.?k.|
+| 12 f9 57 e4 ad 57 0f 59 02 a9 d5 a2 99 f5 c8 1c |..W..W.Y........|
+| 90 84 2c ff 97 be 29 57 1d 16 ee 21 e2 f3 1f ae |..,...)W...!....|
+| f5 25 0f 1a df 9b 85 ca |.%...... |
+Plaintext[104]:
+| 0f b6 f3 e9 59 cb de b5 47 45 54 20 2f 20 48 54 |....Y...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 2d 73 68 |h-dss-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 33 0d 0a 0d |steyn.nl:4443...|
+| 0a 30 b3 29 3d e2 4e 08 46 ce e8 51 6a 61 77 c2 |.0.)=.N.F..Qjaw.|
+| bc 6a b4 9b 16 02 02 02 |.j...... |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 38 8e cb 90 10 df af 98 1b 8d 0c 1c 56 f1 5a f0 |8...........V.Z.|
+| 04 a4 50 46 |..PF |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47475 found (nil)
+association_find: TCP port 4443 found 0x342da70
+
+dissect_ssl enter frame #131 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 33 5f 3a 79 09 d7 bd 7b 84 37 ea 25 af ee e3 ad |3_:y...{.7.%....|
+| ad bf 90 af 9c 41 19 76 ba 56 71 12 3d 40 01 8f |.....A.v.Vq.=@..|
+| 79 b0 66 a4 21 6e 40 d1 d9 22 12 61 72 43 66 f2 |y.f.!n@..".arCf.|
+| c1 d2 40 ba 47 ce bb 41 bc cb 61 d5 fc ed a9 81 |..@.G..A..a.....|
+| 8c 02 fb e2 1a 21 8a 04 25 31 d4 d8 b4 38 8c ae |.....!..%1...8..|
+| 28 47 dd 21 9b a6 02 ed 43 9a 3e 47 a4 31 34 2d |(G.!....C.>G.14-|
+| be 83 2b 8e f5 86 f8 fb d6 30 0e 17 31 c2 83 a4 |..+......0..1...|
+| 44 92 8b 7b d6 0a bf 07 bc 64 70 1b 51 0b 7f fa |D..{.....dp.Q...|
+| 5d 9a da 3a 90 54 87 e8 d2 7d 4f 03 5b 1b d3 01 |]..:.T...}O.[...|
+| fe e9 ea 78 37 39 c0 3a 97 a8 c3 78 75 46 66 a1 |...x79.:...xuFf.|
+| eb b9 b7 52 9d 51 b3 b0 5d 1c 9b 10 45 41 c3 33 |...R.Q..]...EA.3|
+| 64 2e 0b 3a 80 f1 ca db be eb 96 e2 b7 d2 d2 52 |d..:...........R|
+| 52 ba bb df 71 54 b7 22 af ba 05 6f b5 76 5d dc |R...qT."...o.v].|
+| c5 f6 73 fc ea cf 02 c6 7a 7d c1 4e 3f 50 72 83 |..s.....z}.N?Pr.|
+| c4 ca 31 87 50 ae d7 ac c5 9f 28 9a 5d f8 76 a4 |..1.P.....(.].v.|
+| c6 b2 f4 75 a2 a9 d1 f0 7f 6c fe 88 90 0a 90 61 |...u.....l.....a|
+| 7e 44 96 df bd de 2d 12 cd 35 b1 90 b6 20 c3 69 |~D....-..5... .i|
+| f8 81 19 80 7b 95 4b f7 a0 a1 f6 bd 45 23 ef 34 |....{.K.....E#.4|
+| d8 ed 6f 7e 1c 3d b4 22 98 37 d1 0a 53 e2 e5 22 |..o~.=.".7..S.."|
+| 9e 15 02 ad a0 80 dd 75 6a aa 0a ff 45 fd f0 e4 |.......uj...E...|
+| 43 7c b8 21 5f a1 90 25 d3 d5 9e 94 07 e4 fe 59 |C|.!_..%.......Y|
+| fd 2d b7 48 42 8e 69 cb 94 f7 28 fc 19 51 ff 68 |.-.HB.i...(..Q.h|
+| b8 8d 3f ab b7 1f 8c 56 d5 ee ed 51 e6 9c 88 b9 |..?....V...Q....|
+| 85 62 9f 03 f5 7c 4b 96 97 33 03 e6 16 3c e7 1e |.b...|K..3...<..|
+Plaintext[384]:
+| b8 c5 19 0e 41 d7 91 e7 48 54 54 50 2f 31 2e 31 |....A...HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 32 |che....0x00,0x12|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |DSS Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 20 9f 38 33 9a a2 e3 42 08 af 1a 6f |ipt> .83...B...o|
+| cb ac 11 16 62 65 d9 77 07 07 07 07 07 07 07 07 |....be.w........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 58 1b 47 bf a2 88 97 eb 49 d3 35 9c fc a1 4d 5c |X.G.....I.5...M\|
+| 87 07 38 48 |..8H |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4443 found 0x342da70
+
+dissect_ssl enter frame #132 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 6c 54 ca a5 84 57 b5 d7 ea 2e 7a 6e 19 22 f0 6a |lT...W....zn.".j|
+| 3c 55 3f 0a 23 81 3b 04 3e ef cc b8 8f 3f b9 71 |<U?.#.;.>....?.q|
+Plaintext[32]:
+| 7c cf ac eb eb 9f a8 1c 01 00 a8 98 04 64 39 d7 ||............d9.|
+| 7a e9 a5 36 a7 56 6a 02 01 53 eb 29 76 e9 01 01 |z..6.Vj..S.)v...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a8 98 04 64 39 d7 7a e9 a5 36 a7 56 6a 02 01 53 |...d9.z..6.Vj..S|
+| eb 29 76 e9 |.)v. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #134 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 61 19 65 f7 6a d4 16 67 e4 22 76 29 6d 87 2b 0a |a.e.j..g."v)m.+.|
+| d3 55 54 ad c6 3f 72 9d 94 79 af 92 66 42 d5 75 |.UT..?r..y..fB.u|
+Plaintext[32]:
+| d8 42 0a 0d 6e b2 ea ce 01 00 e1 70 ad 00 81 93 |.B..n......p....|
+| 0c ce bb b9 3e ad 2c f7 25 4f 35 d4 84 a4 01 01 |....>.,.%O5.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 70 ad 00 81 93 0c ce bb b9 3e ad 2c f7 25 4f |.p........>.,.%O|
+| 35 d4 84 a4 |5... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #139 (first time)
+ssl_session_init: initializing ptr 0x7facc3824670 size 688
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60402 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4444
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #141 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....|
+| 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.|
+| 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!|
+| f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. |
+hash out[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+PRF out[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+key expansion[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+Client MAC key[20]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c |.\.l |
+Server MAC key[20]:
+| 37 db 48 db cb d1 5f 66 89 d3 97 bc 23 14 07 f3 |7.H..._f....#...|
+| 3f 2a 98 f3 |?*.. |
+Client Write key[24]:
+| 6e fa e9 c3 88 b2 28 69 d0 1f 35 35 20 24 f3 c5 |n.....(i..55 $..|
+| 7f 7e a4 55 ef ec 5c c2 |.~.U..\. |
+Server Write key[24]:
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 |A....... |
+Client Write IV[8]:
+| fd 5a 18 31 d7 61 26 d4 |.Z.1.a&. |
+Server Write IV[8]:
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #143 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763...
+looking for RSA pre-master00806e8987be63f656f700ba3e954714c9a88a06f035968f...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....|
+| 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.|
+| 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!|
+| f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. |
+hash out[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+PRF out[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+key expansion[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+Client MAC key[20]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 |.... |
+Server MAC key[20]:
+| ae 02 2a 8b 57 bb 77 cb 20 36 42 86 bc ec cc f7 |..*.W.w. 6B.....|
+| 05 70 51 21 |.pQ! |
+Client Write key[24]:
+| 4d 74 91 6b 6c 13 a3 36 bc c2 a1 42 0e 76 c1 62 |Mt.kl..6...B.v.b|
+| 95 0e b9 f3 36 f2 52 26 |....6.R& |
+Server Write key[24]:
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b |.r...... |
+Client Write IV[8]:
+| 62 d5 87 44 e9 69 99 06 |b..D.i.. |
+Server Write IV[8]:
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3d b4 f8 fb 08 61 48 c4 35 e1 28 af e7 ea 2a a9 |=....aH.5.(...*.|
+| 4e 3a e1 25 ff 7b 89 56 76 de b6 5b f1 e5 1c 7f |N:.%.{.Vv..[....|
+| 37 eb 87 25 4b d8 3c 74 5f 61 5d 07 03 e2 12 88 |7..%K.<t_a].....|
+Plaintext[48]:
+| bc 0a 68 46 4e 95 79 6d 14 00 00 0c d4 ea 39 85 |..hFN.ym......9.|
+| 6c 0f 5b 03 09 83 4e 1a 54 f7 d5 f7 27 e1 ad be |l.[...N.T...'...|
+| cd be 19 cd b8 1d 31 71 80 66 94 5d 03 03 03 03 |......1q.f.]....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 54 f7 d5 f7 27 e1 ad be cd be 19 cd b8 1d 31 71 |T...'.........1q|
+| 80 66 94 5d |.f.] |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #144 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e2 3d 49 9d 19 74 2f a1 66 a6 e3 df 85 95 eb c0 |.=I..t/.f.......|
+| ba b0 f4 81 8c 0a 2f 2c 69 4e 3a cd 8c 5b 22 88 |....../,iN:..[".|
+| 1e 35 c0 37 ac 07 7b 51 42 8f 9e f9 01 50 8c 71 |.5.7..{QB....P.q|
+Plaintext[48]:
+| eb 1f 06 e1 b5 08 4f ed 14 00 00 0c f0 02 47 0d |......O.......G.|
+| bf 59 da 5d c1 f2 ee 5d 6f 42 c4 e2 0d 73 c0 e6 |.Y.]...]oB...s..|
+| 93 45 ee 70 db f0 76 40 c6 b6 d7 04 03 03 03 03 |.E.p..v@........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6f 42 c4 e2 0d 73 c0 e6 93 45 ee 70 db f0 76 40 |oB...s...E.p..v@|
+| c6 b6 d7 04 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #145 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| f1 70 aa 76 6d 54 da 5f 3b df 55 c0 62 fe f4 4d |.p.vmT._;.U.b..M|
+| b0 f8 d9 f8 5f 82 ba dc 37 b6 db f2 6b 9e 29 44 |...._...7...k.)D|
+| b2 d4 04 04 73 c5 c7 5d d5 51 a9 d6 78 8b f8 b6 |....s..].Q..x...|
+| 80 5f f8 2f ff 71 1f ff 9a 79 c9 1f eb 32 f8 7f |._./.q...y...2..|
+| d8 85 f4 6f 0e 69 47 97 74 2f 72 9c 05 57 f9 b5 |...o.iG.t/r..W..|
+| e8 c7 ba 1e 8b 98 cc 24 0d 3b 2a 06 33 a2 de 67 |.......$.;*.3..g|
+| d8 5b 54 02 6d 50 2c 10 |.[T.mP,. |
+Plaintext[104]:
+| 00 07 22 1f 29 76 f6 80 47 45 54 20 2f 20 48 54 |..".)v..GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 33 2d 73 |h-dss-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 34 0d 0a |nsteyn.nl:4444..|
+| 0d 0a 96 9f 44 31 43 3b 0d 29 39 e8 f9 eb 8a d5 |....D1C;.)9.....|
+| d0 4e 5c 4b af db 01 01 |.N\K.... |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 76 76 10 c4 72 f9 ee 57 03 a4 f7 5a f8 07 8f |yvv..r..W...Z...|
+| 9d 11 4b ae |..K. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60402 found (nil)
+association_find: TCP port 4444 found 0x342db00
+
+dissect_ssl enter frame #146 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 48 80 aa 19 51 37 56 3a fe 0c ac c5 6a 89 88 41 |H...Q7V:....j..A|
+| 83 d7 41 29 5e ec bc 53 ae 2f 15 7f 20 51 37 d1 |..A)^..S./.. Q7.|
+| c9 45 97 9d cc 33 21 53 52 a6 cd 4c 0d ae 9c 35 |.E...3!SR..L...5|
+| bf 24 4d 95 21 fa db 64 45 2c 79 9c 50 05 62 e8 |.$M.!..dE,y.P.b.|
+| 40 f9 95 d2 4e c3 d4 73 a4 c6 ea ce 27 df d8 bb |@...N..s....'...|
+| 03 f4 b9 b7 b0 6d 0d ac 68 87 6e 0a 6c dd 2e a9 |.....m..h.n.l...|
+| 45 8f 56 80 7a 1c 1a 3a e4 1e 2e fc 5e 36 9e cf |E.V.z..:....^6..|
+| 27 04 c9 49 f4 c7 ee 5d 50 32 30 6e 97 0a 06 6c |'..I...]P20n...l|
+| 49 13 f4 dc f9 d9 4a ea f5 4a 6f 0e 85 73 e4 46 |I.....J..Jo..s.F|
+| 26 67 c3 66 37 eb 30 05 1f 7f 40 f9 9a ee 22 77 |&g.f7.0...@..."w|
+| e0 a8 7d e5 e4 bc fd 55 56 45 e0 9d a7 08 d7 20 |..}....UVE..... |
+| 19 d2 c4 b1 dc 44 a7 6e 24 94 e0 5f 16 52 0e 79 |.....D.n$.._.R.y|
+| 62 bf 29 6c 7a e7 6a 60 97 4c d8 6f fc d4 ed c0 |b.)lz.j`.L.o....|
+| c3 ab 1c 5d 61 3b c2 16 a9 9c a2 af 51 d9 3b 80 |...]a;......Q.;.|
+| 5a b6 76 1e bb 5a e8 14 5e b9 6b f8 fb 64 ea 86 |Z.v..Z..^.k..d..|
+| 86 63 d5 ef 0b c4 af 4d 13 6e 70 2d cf 84 66 1f |.c.....M.np-..f.|
+| 20 40 f7 8b f5 1d 74 97 3f 9f 64 ea 74 ee 1a c1 | @....t.?.d.t...|
+| 34 aa 95 f1 94 69 d2 46 11 59 94 eb da 4c 62 03 |4....i.F.Y...Lb.|
+| 2a 0e 5d 28 38 4e d2 2a 0f c3 35 47 fe ef 18 02 |*.](8N.*..5G....|
+| 3f ba 8a 16 fd d3 22 ad 2c a3 4e 5f 32 3b fa 06 |?.....".,.N_2;..|
+| be 2c 86 2d cc 04 cc 13 bb 74 74 06 ce 04 3f e6 |.,.-.....tt...?.|
+| 34 02 c0 12 d8 12 85 24 96 20 7d dc a7 ac c1 73 |4......$. }....s|
+| b5 86 3a 57 bd 36 b2 5d ab 1c 34 b6 25 ef 23 fd |..:W.6.]..4.%.#.|
+| 08 70 a1 18 f9 a0 e6 ee e3 0a 07 b5 be c1 4a f0 |.p............J.|
+Plaintext[384]:
+| 13 7e 91 e2 f6 09 fe 19 48 54 54 50 2f 31 2e 31 |.~......HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 33 |che....0x00,0x13|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |DSS Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 55 7c 3d a5 5b 31 0f bd a7 68 12 1d |ipt>U|=.[1...h..|
+| 9e 1e 3e 8d c8 49 d9 fb 07 07 07 07 07 07 07 07 |..>..I..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 e5 78 6d b1 ab a3 e1 9c 04 a9 ed c1 18 47 75 |..xm..........Gu|
+| 57 48 1a d0 |WH.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4444 found 0x342db00
+
+dissect_ssl enter frame #147 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 46 e5 ca 45 bf 17 ae 99 1d 63 48 ac 68 a7 8f c0 |F..E.....cH.h...|
+| 04 85 49 77 c6 f0 2f 07 6b 2b 96 29 da fa 7f 1c |..Iw../.k+.)....|
+Plaintext[32]:
+| 2b db 5a 85 9f 08 7d 2a 01 00 3f 62 e6 81 09 83 |+.Z...}*..?b....|
+| a1 cb 1c a7 6d c6 77 b2 12 61 c7 b2 b0 a1 01 01 |....m.w..a......|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3f 62 e6 81 09 83 a1 cb 1c a7 6d c6 77 b2 12 61 |?b........m.w..a|
+| c7 b2 b0 a1 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #149 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 23 b5 78 ef 9c fd 59 77 25 f4 d1 11 9b 8a a6 4c |#.x...Yw%......L|
+| 3e de 4d 7c 56 4a e7 8d a1 ae 60 10 39 2d 24 3d |>.M|VJ....`.9-$=|
+Plaintext[32]:
+| d9 af 1f 9a d2 49 80 20 01 00 bf d8 8b 27 b3 fe |.....I. .....'..|
+| 69 fe e2 33 df ca 62 67 18 14 0d b9 2f fa 01 01 |i..3..bg..../...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf d8 8b 27 b3 fe 69 fe e2 33 df ca 62 67 18 14 |...'..i..3..bg..|
+| 0d b9 2f fa |../. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #154 (first time)
+ssl_session_init: initializing ptr 0x7facc3826bb0 size 688
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34412 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4446
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #156 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&|
+| 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.|
+| 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.|
+| 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. |
+hash out[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+PRF out[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+key expansion[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+Client MAC key[20]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 |.... |
+Server MAC key[20]:
+| 81 3c 17 4b ea 5b 38 48 44 0b 95 49 33 e8 ed ec |.<.K.[8HD..I3...|
+| 28 b9 92 2c |(.., |
+Client Write key[8]:
+| 5e be 00 1b 1d 30 f4 f0 |^....0.. |
+Server Write key[8]:
+| 18 7b 14 b0 b8 28 b0 27 |.{...(.' |
+Client Write IV[8]:
+| 4a 42 80 b6 5c 6d 9a 3a |JB..\m.: |
+Server Write IV[8]:
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #158 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7ca...
+looking for RSA pre-master00802a0d0f85b40a6903ecad2f96c85838fd915f30332c23...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&|
+| 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.|
+| 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.|
+| 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. |
+hash out[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+PRF out[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+key expansion[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+Client MAC key[20]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 |.\.. |
+Server MAC key[20]:
+| 66 4d c1 30 25 31 1f db f1 10 d5 01 8a c7 be e9 |fM.0%1..........|
+| ed 6d bb 1d |.m.. |
+Client Write key[8]:
+| 19 6e cb 8b c1 4b be 46 |.n...K.F |
+Server Write key[8]:
+| 0e f1 af d3 a8 40 ab b9 |.....@.. |
+Client Write IV[8]:
+| 5b ee 4b 96 c2 f2 fc e7 |[.K..... |
+Server Write IV[8]:
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b3 b6 3f 49 fc 09 ff a9 48 23 89 ce eb 96 cb 40 |..?I....H#.....@|
+| f4 01 16 65 eb a2 9c 3b 07 06 b2 ce 19 74 84 f3 |...e...;.....t..|
+| fa 1d 36 49 64 a8 d9 07 9b f7 9c ee a2 6a 62 f7 |..6Id........jb.|
+Plaintext[48]:
+| 0d 58 46 d4 81 13 c3 af 14 00 00 0c a6 c3 1a 90 |.XF.............|
+| 66 71 e6 58 35 bf 82 67 4b 33 ee 3b 64 a4 1c 28 |fq.X5..gK3.;d..(|
+| 63 d1 e4 03 68 9f 8b d5 f6 a9 99 4d 03 03 03 03 |c...h......M....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4b 33 ee 3b 64 a4 1c 28 63 d1 e4 03 68 9f 8b d5 |K3.;d..(c...h...|
+| f6 a9 99 4d |...M |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #159 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e3 a5 44 22 cf 49 d2 2c 86 74 db ca e4 89 2f eb |..D".I.,.t..../.|
+| 02 4d 14 46 12 6b f4 8d cd e8 e1 56 de 2c e9 b4 |.M.F.k.....V.,..|
+| 73 5b 3d ef 93 11 2f 22 e4 35 36 81 58 13 37 c0 |s[=.../".56.X.7.|
+Plaintext[48]:
+| 5a 53 b7 d8 09 0e 69 39 14 00 00 0c 89 dc 88 bc |ZS....i9........|
+| da 02 87 a9 e3 73 18 6d 8c 14 3d 07 e0 a6 ab 15 |.....s.m..=.....|
+| 47 60 d6 7f 57 f4 0e 6c 98 9c 03 79 03 03 03 03 |G`..W..l...y....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c 14 3d 07 e0 a6 ab 15 47 60 d6 7f 57 f4 0e 6c |..=.....G`..W..l|
+| 98 9c 03 79 |...y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #160 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 69 f8 b1 df d5 c9 14 65 da 4d dc cc cb 60 f6 70 |i......e.M...`.p|
+| 17 ce 72 33 63 28 75 31 47 d9 60 e7 86 1e 24 43 |..r3c(u1G.`...$C|
+| 1e 2f 8a 28 1c d1 af d7 62 7e 48 f7 4a 97 37 2d |./.(....b~H.J.7-|
+| 2c d6 31 92 cd e1 e6 aa 04 ea 83 49 6f 7e 86 e2 |,.1........Io~..|
+| e0 6a 91 b3 23 96 cf 14 ec 3d 74 41 ac 9b 87 ed |.j..#....=tA....|
+| 20 30 2b e6 4c 29 42 19 05 f9 7b 79 68 6e 6d 7a | 0+.L)B...{yhnmz|
+| a1 45 ab 4f 5b e0 12 5e |.E.O[..^ |
+Plaintext[104]:
+| e4 17 15 58 70 29 4b ad 47 45 54 20 2f 20 48 54 |...Xp)K.GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 2d 73 68 |h-rsa-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 36 0d 0a 0d |steyn.nl:4446...|
+| 0a b7 db 5d 0e f4 87 18 bc e9 71 24 4f 65 b0 34 |...]......q$Oe.4|
+| 88 b9 9b f3 f4 02 02 02 |........ |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4c f5 c4 9e d5 1d 75 68 cc fb 2a dd e2 ef c0 81 |L.....uh..*.....|
+| 11 ca 8b e4 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34412 found (nil)
+association_find: TCP port 4446 found 0x342dc20
+
+dissect_ssl enter frame #161 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 96 f2 81 e6 42 8c 20 31 a7 de b2 81 4a 35 4d 95 |....B. 1....J5M.|
+| 68 85 5d 50 c9 22 9c e8 0d 87 8f 3f ec 03 58 3d |h.]P.".....?..X=|
+| 39 b0 25 3b 99 d6 7f 3a ca 77 29 72 89 5c 3b 46 |9.%;...:.w)r.\;F|
+| 22 d9 13 ca 53 aa 28 bc 13 07 9a 36 db 38 3b ca |"...S.(....6.8;.|
+| 8a 48 a0 12 1b 90 80 38 7f 14 d8 a6 be fb 63 15 |.H.....8......c.|
+| 12 56 44 dd 21 5a 6e 36 1a fb 12 b0 ae 9c 4b a3 |.VD.!Zn6......K.|
+| b3 2f e9 42 d1 e9 48 45 ec 26 91 52 01 dc fa a6 |./.B..HE.&.R....|
+| 58 1e 0f 49 b0 cd 7d d0 99 f0 e1 86 43 c6 f8 84 |X..I..}.....C...|
+| f2 7a f9 31 c5 cb d6 3d 55 f9 81 e2 cf 33 3f 66 |.z.1...=U....3?f|
+| 23 af 96 71 ab 28 9d c9 42 99 7a 33 f9 d0 38 07 |#..q.(..B.z3..8.|
+| 8e d5 35 e8 68 a5 0f 53 21 08 ef 18 08 46 de 67 |..5.h..S!....F.g|
+| 1d 30 d6 9c 33 fa 98 91 55 fc 53 fc 44 9e a6 79 |.0..3...U.S.D..y|
+| 4d 90 53 aa b5 3e 0a d1 04 5e 4d 7e 27 d4 1b 87 |M.S..>...^M~'...|
+| 27 e0 18 1b e3 40 e1 a4 1c fb e7 5e 97 91 ba 15 |'....@.....^....|
+| 3e 76 f5 57 66 4b 15 ee 79 43 60 60 18 05 8e 52 |>v.WfK..yC``...R|
+| 11 2f ae 8c 06 44 a5 e5 ac 51 12 b2 7a b1 d4 10 |./...D...Q..z...|
+| 1d 3b f3 55 c4 ce de d0 71 a5 6a 4e eb 44 23 d6 |.;.U....q.jN.D#.|
+| 4e 75 49 46 7f c9 86 70 b1 64 5f 8e b5 5e 2b 1c |NuIF...p.d_..^+.|
+| 63 bb 83 00 f7 8e 88 b7 10 1e 50 6e f5 06 0a d4 |c.........Pn....|
+| 1a 27 a2 c8 c6 61 b9 39 a8 ee 82 1d 6f 18 b1 6d |.'...a.9....o..m|
+| 69 cd a5 0e 0e c3 ba 50 c0 de 12 d0 d5 51 70 57 |i......P.....QpW|
+| 09 02 d0 f2 71 aa 21 fc 39 de 0b 60 bf da fd 4f |....q.!.9..`...O|
+| f7 00 7e 32 03 d6 13 22 f2 07 a9 a6 23 e6 d2 13 |..~2..."....#...|
+| 45 cb 55 41 f6 5b 44 df a0 f6 64 4c 9c 2b 79 e7 |E.UA.[D...dL.+y.|
+Plaintext[384]:
+| 76 ac 3b fa b1 54 fa 6a 48 54 54 50 2f 31 2e 31 |v.;..T.jHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 35 |che....0x00,0x15|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e ef e0 8d f6 e3 0b ba 9e 8c ff 31 a8 |ipt>..........1.|
+| 60 89 37 f1 94 ad fd a2 07 07 07 07 07 07 07 07 |`.7.............|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c6 8e 88 6c 4a 0d 2f 24 5a e6 9d 8b ed 1c 68 0f |...lJ./$Z.....h.|
+| 59 41 2e 7d |YA.} |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4446 found 0x342dc20
+
+dissect_ssl enter frame #162 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 90 f6 07 04 e0 4a 07 59 f3 0d 7c 9d c1 fc d7 8a |.....J.Y..|.....|
+| fb d1 9d 5f 88 e9 38 90 30 0f 6f e4 69 5d 4a 1a |..._..8.0.o.i]J.|
+Plaintext[32]:
+| 0c 1a e1 d4 78 6a da 00 01 00 9c 5a 40 9d db f4 |....xj.....Z@...|
+| 05 13 fa 7e 0e cd 31 cd 8d d0 df 9c 0a da 01 01 |...~..1.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 5a 40 9d db f4 05 13 fa 7e 0e cd 31 cd 8d d0 |.Z@......~..1...|
+| df 9c 0a da |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #164 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 7d d7 c0 e6 96 9e 50 c3 7f d0 b5 0d cc dd 53 da |}.....P.......S.|
+| 00 42 4e 39 07 ec 5e 40 5f 00 f0 c5 3b 4c 04 78 |.BN9..^@_...;L.x|
+Plaintext[32]:
+| e2 0d bf b8 8a be e4 0b 01 00 de 63 97 d3 6f d6 |...........c..o.|
+| ad f1 c0 fc 08 53 a9 a7 e9 d6 c5 46 d0 da 01 01 |.....S.....F....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| de 63 97 d3 6f d6 ad f1 c0 fc 08 53 a9 a7 e9 d6 |.c..o......S....|
+| c5 46 d0 da |.F.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #169 (first time)
+ssl_session_init: initializing ptr 0x7facc38290b0 size 688
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34630 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4447
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #171 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....|
+| 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.|
+| 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.|
+| 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ |
+hash out[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+PRF out[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+key expansion[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+Client MAC key[20]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb |&B.. |
+Server MAC key[20]:
+| 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 fe 14 37 f3 |...A.j.~.#CR..7.|
+| bd 43 0e af |.C.. |
+Client Write key[24]:
+| e9 bf 44 8f 11 9c 68 9a d3 37 a3 40 39 62 09 8b |..D...h..7.@9b..|
+| b8 79 3b 5e d1 73 93 10 |.y;^.s.. |
+Server Write key[24]:
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 |...~h..Y |
+Client Write IV[8]:
+| cc bd 9c 99 62 ff 6c e8 |....b.l. |
+Server Write IV[8]:
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #173 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312...
+looking for RSA pre-master008027b568fcd473db04087fdc9b05310f3c92161bfb26f1...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....|
+| 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.|
+| 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.|
+| 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ |
+hash out[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+PRF out[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+key expansion[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+Client MAC key[20]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 |VO.. |
+Server MAC key[20]:
+| 7e fb 12 39 31 6f ee 5b 60 90 90 b6 77 e0 70 41 |~..91o.[`...w.pA|
+| 92 17 12 71 |...q |
+Client Write key[24]:
+| 5e ed bf 9a a0 fe 96 7f d5 7b 92 8d 8c b3 5e 40 |^........{....^@|
+| 78 f7 06 49 d9 c2 4f 90 |x..I..O. |
+Server Write key[24]:
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 |z.|..*.! |
+Client Write IV[8]:
+| 7f 2b 21 ed eb 3c b3 bb |.+!..<.. |
+Server Write IV[8]:
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 30 b9 99 b5 98 3a 51 ba 34 9f 5f c3 fa 03 14 a5 |0....:Q.4._.....|
+| ff 2b 4c e7 1d 75 8e 9b 9f 7e 1a f7 9c 04 c5 7b |.+L..u...~.....{|
+| ef 9d e7 8d d3 52 a8 f2 60 1e 56 3e 94 1c 79 75 |.....R..`.V>..yu|
+Plaintext[48]:
+| 11 54 ba b8 2b 47 c3 13 14 00 00 0c d4 0c 3a 75 |.T..+G........:u|
+| 2f ae 37 1c 80 8e f4 b6 bf eb f9 f3 74 05 e3 b2 |/.7.........t...|
+| 8a 91 5f 39 26 39 24 10 89 96 19 d6 03 03 03 03 |.._9&9$.........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf eb f9 f3 74 05 e3 b2 8a 91 5f 39 26 39 24 10 |....t....._9&9$.|
+| 89 96 19 d6 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #174 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 43 b9 41 64 c5 c1 70 d9 95 40 43 89 6d 6a 0f 7e |C.Ad..p..@C.mj.~|
+| 1f b0 d1 8b 8e cc 05 85 5e 1d 64 05 7f c3 18 6c |........^.d....l|
+| 1b 6f fb 98 8c 36 f4 92 5f 58 6d 29 af b8 1b b3 |.o...6.._Xm)....|
+Plaintext[48]:
+| 3e 8c 1e 41 11 1c 02 94 14 00 00 0c b1 af 5a f7 |>..A..........Z.|
+| 46 79 f1 9d 13 16 f8 d6 77 48 26 28 97 92 87 35 |Fy......wH&(...5|
+| 2e 9a 77 58 79 64 5d 3f 37 26 30 58 03 03 03 03 |..wXyd]?7&0X....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 77 48 26 28 97 92 87 35 2e 9a 77 58 79 64 5d 3f |wH&(...5..wXyd]?|
+| 37 26 30 58 |7&0X |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #175 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 52 25 de 8e dc 51 1e 44 7a 04 36 3a fe f7 5a 2a |R%...Q.Dz.6:..Z*|
+| f8 c6 0a 28 6a be ce 44 47 9c 36 9c d8 16 86 a8 |...(j..DG.6.....|
+| b5 23 27 08 96 eb 4c dc 09 0d 57 27 71 3f 75 cb |.#'...L...W'q?u.|
+| 04 3f 78 fa a6 3c 32 bc ec 2a 1e 66 71 b3 22 bd |.?x..<2..*.fq.".|
+| b7 0a bd 82 68 aa 70 a1 cd 99 a9 70 c8 cd 74 a5 |....h.p....p..t.|
+| ad 7f 52 6f d0 71 4e 94 d3 09 dc 9f 01 d5 d2 4e |..Ro.qN........N|
+| f9 48 cc ac 0a 66 40 37 |.H...f@7 |
+Plaintext[104]:
+| c8 61 50 07 a9 8d 67 44 47 45 54 20 2f 20 48 54 |.aP...gDGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 2d 73 |h-rsa-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 37 0d 0a |nsteyn.nl:4447..|
+| 0d 0a 4d a5 7b 38 2e 13 89 3f e6 db 22 e5 fa 38 |..M.{8...?.."..8|
+| f2 c8 c6 33 1e c6 01 01 |...3.... |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 2f 5b bd d8 8f 3f f3 2f 99 b0 8a ef fc 8b df |]/[...?./.......|
+| a4 d6 01 22 |..." |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34630 found (nil)
+association_find: TCP port 4447 found 0x342dcb0
+
+dissect_ssl enter frame #176 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c6 a7 90 28 b2 f1 b7 15 43 62 7a 8e 57 14 47 11 |...(....Cbz.W.G.|
+| 8b 43 bb 7f c5 53 21 ef 53 53 a5 a0 11 37 66 6f |.C...S!.SS...7fo|
+| 1a db 78 e4 e2 3c 2e 19 51 bb ec 08 06 33 6e ac |..x..<..Q....3n.|
+| c8 96 d3 5d 06 de 57 71 89 ad 14 97 38 9f f2 f2 |...]..Wq....8...|
+| 05 06 8c 49 c0 00 0f 08 de 60 e2 2c ed 57 bd 7a |...I.....`.,.W.z|
+| b0 75 2e 8f 92 28 5e 0a 49 ef 83 86 4f 05 eb f9 |.u...(^.I...O...|
+| f5 4a 7a 69 e2 bc d5 be 68 c7 52 b9 3c 98 b3 50 |.Jzi....h.R.<..P|
+| ae b3 de 52 cc a7 61 fd bf af a9 f0 e3 cc d6 54 |...R..a........T|
+| 9b 45 a5 94 26 58 87 cf 51 63 aa 82 56 9b 3e b1 |.E..&X..Qc..V.>.|
+| fe 6f 12 74 f2 1c ae 8b 7c 7b bd a4 c0 d0 6f 17 |.o.t....|{....o.|
+| b9 50 61 6e 51 02 32 19 54 1a 57 a2 d5 9e a5 0a |.PanQ.2.T.W.....|
+| 14 3c e9 f7 11 84 7d ad e8 d7 7d 0c 07 4c 3f 57 |.<....}...}..L?W|
+| ac 44 b8 a9 f0 c7 2e db 53 12 81 99 4a 0e 6a e4 |.D......S...J.j.|
+| c6 fb 54 9b bf 9a c3 e2 a9 f0 68 34 c3 95 74 34 |..T.......h4..t4|
+| 6c f2 8c 77 3d 57 b7 a0 c3 f8 cd 04 5b 15 5e 41 |l..w=W......[.^A|
+| 53 13 85 50 fc 72 27 a2 7b 84 0b b1 66 9b a5 eb |S..P.r'.{...f...|
+| 35 ad e4 cf fa 58 29 07 78 79 f5 14 c0 34 2d b2 |5....X).xy...4-.|
+| a2 b9 25 1c 87 83 63 13 c3 60 87 b7 c9 94 5f 10 |..%...c..`...._.|
+| 4e 5a 94 63 18 2f 23 39 1b 0e f3 d5 13 27 a8 a5 |NZ.c./#9.....'..|
+| 51 9f 1c e3 c1 6e 24 b7 c6 ec 19 a2 8b a0 37 8e |Q....n$.......7.|
+| 3e 5e da aa 5e 37 9f 36 c6 d3 33 15 96 a2 7b 62 |>^..^7.6..3...{b|
+| 63 1b 6a af 83 e8 48 71 77 92 13 49 5f 09 53 5a |c.j...Hqw..I_.SZ|
+| 81 b0 a7 be 34 02 fe dd 05 41 32 91 41 df 80 9a |....4....A2.A...|
+| 4e 78 88 1c a7 90 dd 6a 98 9b ec a0 73 0c 1a 1a |Nx.....j....s...|
+Plaintext[384]:
+| 15 08 3a 52 13 84 ff 32 48 54 54 50 2f 31 2e 31 |..:R...2HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 36 |che....0x00,0x16|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e e2 99 45 65 8c 16 05 3b 22 43 65 8b |ipt>..Ee...;"Ce.|
+| bb 26 09 2a 69 d1 2c 94 07 07 07 07 07 07 07 07 |.&.*i.,.........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6e 38 8e 36 a4 fc f7 22 c3 52 d5 c3 70 e0 30 e9 |n8.6...".R..p.0.|
+| fc bb 46 de |..F. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4447 found 0x342dcb0
+
+dissect_ssl enter frame #177 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 55 ee a8 58 43 84 d9 46 e9 af a2 07 a7 c0 5a e5 |U..XC..F......Z.|
+| 9b f6 7e d0 b3 3d 25 37 88 45 a1 00 c8 e7 dc be |..~..=%7.E......|
+Plaintext[32]:
+| 28 c5 00 a5 16 dd 5e e0 01 00 d3 7a ba cf ea 38 |(.....^....z...8|
+| ec 1b 2d ef 78 0d 34 2f 3c 11 c4 bf 08 70 01 01 |..-.x.4/<....p..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d3 7a ba cf ea 38 ec 1b 2d ef 78 0d 34 2f 3c 11 |.z...8..-.x.4/<.|
+| c4 bf 08 70 |...p |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #179 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 76 68 33 16 36 aa 6b 09 b6 a9 34 b1 61 c6 fb e3 |vh3.6.k...4.a...|
+| b3 8d dd 81 3c e8 4e 02 9b 85 fe 37 c5 24 96 97 |....<.N....7.$..|
+Plaintext[32]:
+| f2 a4 38 4d 1e 1c 93 cd 01 00 a9 6f f3 6d 2b ba |..8M.......o.m+.|
+| a6 3d 8a 8c 6b 65 e4 84 4c 61 1e 50 86 a7 01 01 |.=..ke..La.P....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a9 6f f3 6d 2b ba a6 3d 8a 8c 6b 65 e4 84 4c 61 |.o.m+..=..ke..La|
+| 1e 50 86 a7 |.P.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #184 (first time)
+ssl_session_init: initializing ptr 0x7facc382b5b0 size 688
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56585 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4448
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #186 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.|
+| 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.|
+| 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>|
+| a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 |
+hash out[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+PRF out[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+key expansion[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+Client MAC key[20]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 |.... |
+Server MAC key[20]:
+| 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa ad d1 8c e4 |....."v.........|
+| 18 60 e9 b7 |.`.. |
+Client Write key[16]:
+| 17 32 20 aa 71 e4 51 58 de 29 07 4f ff 5f 42 28 |.2 .q.QX.).O._B(|
+Server Write key[16]:
+| d3 6a 06 82 7d 52 e0 44 ee 97 db df 7c c4 f5 41 |.j..}R.D....|..A|
+Client Write IV[16]:
+| 20 8e 7e 43 da 31 84 17 ac 47 27 8a 28 19 f1 07 | .~C.1...G'.(...|
+Server Write IV[16]:
+| 22 b5 68 ef 27 e0 f2 e4 ed cc 53 e8 a9 38 28 61 |".h.'.....S..8(a|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #188 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b45632...
+looking for RSA pre-master9c6ff5543ffe32d8ea3a28bd01a06a2390bf507ff9296aa5...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.|
+| 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.|
+| 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>|
+| a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 |
+hash out[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+PRF out[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+key expansion[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+Client MAC key[20]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 |...Q |
+Server MAC key[20]:
+| b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 52 0a 0e 02 |.>m_.U_.....R...|
+| 08 16 57 da |..W. |
+Client Write key[16]:
+| ab 14 c4 af 42 91 20 e7 7b ab 41 ae 53 6e cd f4 |....B. .{.A.Sn..|
+Server Write key[16]:
+| 0c bc fb 0d 51 58 b0 25 f8 2f ad 6d 7f 2a 02 13 |....QX.%./.m.*..|
+Client Write IV[16]:
+| 88 73 65 2e c7 b4 3d 1c 94 d0 61 28 cb 66 35 71 |.se...=...a(.f5q|
+Server Write IV[16]:
+| 8d 3c 54 51 6b a4 ad 6e b9 f8 29 05 96 08 f3 3a |.<TQk..n..)....:|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c4 5f 91 3d 25 a3 a0 22 e2 b3 ce d7 2f bc a8 c4 |._.=%.."..../...|
+| cb c5 84 32 41 c8 2b 56 21 8a 35 52 8d 10 75 8e |...2A.+V!.5R..u.|
+| 88 64 2e 9f d2 3d de 0b 9f 0c 81 7b 8d 4d 84 7d |.d...=.....{.M.}|
+| 13 f2 7a de a0 b1 7c f2 49 47 a3 1d 54 d8 21 c2 |..z...|.IG..T.!.|
+Plaintext[64]:
+| 42 32 46 39 d0 4d be 41 8f fd 10 5c 03 8d bd e5 |B2F9.M.A...\....|
+| 14 00 00 0c d7 7e 6a cc d7 b3 00 df 6d b0 63 5c |.....~j.....m.c\|
+| cc 88 c6 58 79 79 94 70 2c c0 96 b2 46 46 3b b8 |...Xyy.p,...FF;.|
+| 9c 03 33 23 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..3#............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc 88 c6 58 79 79 94 70 2c c0 96 b2 46 46 3b b8 |...Xyy.p,...FF;.|
+| 9c 03 33 23 |..3# |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #189 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c1 95 8f 38 a1 6a 07 72 17 43 58 54 ce 3a 60 16 |...8.j.r.CXT.:`.|
+| 81 0e 88 88 0c 61 ef 44 7d f2 42 30 f5 3b 3b ed |.....a.D}.B0.;;.|
+| a6 d6 ad 17 8d 28 b9 83 3f 0a 28 5c 52 14 10 6a |.....(..?.(\R..j|
+| 99 3f 04 51 28 5f 2a c8 73 bc 67 8d b5 bb e3 00 |.?.Q(_*.s.g.....|
+Plaintext[64]:
+| 7a 52 ad d1 45 cd ea e1 f0 72 5d 2d d8 ec 3b c0 |zR..E....r]-..;.|
+| 14 00 00 0c 85 21 68 ab 47 e2 12 2b 15 da 6e 75 |.....!h.G..+..nu|
+| a1 ed 97 a5 ed e6 97 53 8a ca f2 f2 f1 e1 96 ab |.......S........|
+| 9d 69 73 dc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.is.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 ed 97 a5 ed e6 97 53 8a ca f2 f2 f1 e1 96 ab |.......S........|
+| 9d 69 73 dc |.is. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #190 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| e1 38 a1 61 b3 19 97 8a bc 0f 7b c6 39 7f 51 73 |.8.a......{.9.Qs|
+| e3 3f c7 f3 a9 cc 79 13 3a fa c8 4e f4 32 a5 2e |.?....y.:..N.2..|
+| 03 da a6 93 d0 62 a3 4c 69 b2 8e 0d 79 8f 63 ec |.....b.Li...y.c.|
+| f3 dc fd da cc 76 d3 ab 35 10 21 22 ef 16 f1 5d |.....v..5.!"...]|
+| a8 e8 35 a7 88 77 fc 30 c1 a9 cc 2a 6f 2d 3b 16 |..5..w.0...*o-;.|
+| 18 81 40 b2 41 6a e7 b5 27 6b 9b 13 97 39 9e 9e |..@.Aj..'k...9..|
+| 9b 64 79 71 19 73 c6 6b 3b 29 5a a9 b0 a0 ec 24 |.dyq.s.k;)Z....$|
+Plaintext[112]:
+| f7 fe 40 28 7b 7e 0b 38 a1 02 cd 75 e6 1c 3e 78 |..@({~.8...u..>x|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....|
+| 90 ab af 77 9f 92 99 2f 13 ca b2 56 b2 0a 6c 6a |...w.../...V..lj|
+| af 9c 0b fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc ad 88 d7 c0 ce ec 90 81 5c f5 2b dd 8b 99 6e |.........\.+...n|
+| 3b be 1b 69 |;..i |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56585 found (nil)
+association_find: TCP port 4448 found 0x342dd40
+
+dissect_ssl enter frame #191 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 18 93 55 f3 49 26 2e 7f e3 2e 94 24 ca 57 3a 5b |..U.I&.....$.W:[|
+| 21 e3 43 4d bf 63 46 ee e3 6a e9 07 96 68 30 57 |!.CM.cF..j...h0W|
+| 94 15 f0 2c 57 37 23 39 2f f7 bc cd fb 4d 15 8f |...,W7#9/....M..|
+| f6 88 0d 09 fa 08 ab 34 fd b9 59 1b 4b 4a ee 81 |.......4..Y.KJ..|
+| 1d e9 14 80 1a 89 68 bf e0 2e 69 53 b9 17 00 96 |......h...iS....|
+| a1 69 1d 6e 69 0e 2a 0f 1e 82 d1 56 2d 05 64 31 |.i.ni.*....V-.d1|
+| e4 44 a4 4f fa 23 a6 fc 68 32 be 15 f6 b9 ac 6f |.D.O.#..h2.....o|
+| 19 30 ea 4d a1 08 04 65 03 17 91 88 b6 0e be 78 |.0.M...e.......x|
+| ec 3e 35 d7 89 dd d1 5b 16 b9 ac 75 2c 7e e7 ab |.>5....[...u,~..|
+| 50 4f b7 73 ca 30 fd f6 a1 4c c9 ab 85 08 5e 09 |PO.s.0...L....^.|
+| 71 b5 bf ee 5e b0 92 06 0a 43 5b c7 16 f3 71 ab |q...^....C[...q.|
+| ed ae 5f e2 2d 8e d1 2d 45 ba 20 aa 4f ce ad 60 |.._.-..-E. .O..`|
+| 33 9d b0 7f dd 4e 60 c0 18 52 92 1b 72 98 d6 79 |3....N`..R..r..y|
+| 9a a5 18 fc 48 73 77 42 10 dc 13 20 55 16 cb ec |....HswB... U...|
+| 61 c5 71 86 fa 22 9b f2 a5 f0 ed 54 cb 96 a1 4d |a.q..".....T...M|
+| e3 af 35 c0 98 48 86 2a 7c 20 60 61 f2 82 6b 06 |..5..H.*| `a..k.|
+| 9b e1 9b 28 8a 99 8b c8 be 95 6b f6 76 c5 89 fb |...(......k.v...|
+| 3c 60 01 ed 6b 44 df 94 dd f8 9e cc a2 01 30 02 |<`..kD........0.|
+| 9f 71 30 82 33 21 89 92 02 d1 e5 bf f6 8a 94 f8 |.q0.3!..........|
+| bc 21 09 a0 c1 9f aa 0a 6d 82 43 0a e4 a0 a5 59 |.!......m.C....Y|
+| b4 e0 38 26 6e 13 03 61 d1 2e bc ab 61 94 c2 0d |..8&n..a....a...|
+| 60 b8 d4 92 73 3a bf f8 90 ee f9 92 f5 3d 10 57 |`...s:.......=.W|
+| 68 a8 65 11 94 be b2 4c 7a d7 72 a7 56 b0 15 71 |h.e....Lz.r.V..q|
+| 3f cd 2f 1a c4 c9 3f 27 d0 bc 0f aa fa b2 14 81 |?./...?'........|
+| f2 e2 ac 23 1d 5d 6e 09 34 b8 b9 ee 35 29 93 e0 |...#.]n.4...5)..|
+Plaintext[400]:
+| 1b bd f3 c6 cc 1c 1c f8 eb af 5e 18 ba bd c3 40 |..........^....@|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12|
+| 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9b 46 ca 65 |nl'</script>.F.e|
+| 92 cf d8 33 79 d6 e7 4c 0e 7a 91 81 cc 1b 00 43 |...3y..L.z.....C|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 55 4f b0 3a ac 07 a7 cb 7e f5 2b a5 9d 48 19 71 |UO.:....~.+..H.q|
+| 56 15 b9 89 |V... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4448 found 0x342dd40
+
+dissect_ssl enter frame #192 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2d 7e 64 d1 d4 bb b7 06 06 ab 93 21 37 b1 58 fd |-~d........!7.X.|
+| 98 fe 27 e2 6a 7c b3 6a d7 be be 21 6e 6a 8b 98 |..'.j|.j...!nj..|
+| 91 c8 8d 1c 36 d5 84 4f b8 23 02 24 d8 cf 62 ad |....6..O.#.$..b.|
+Plaintext[48]:
+| c1 5d 52 33 77 47 a6 d0 8b 1c eb 6b 9f 6d 9f e6 |.]R3wG.....k.m..|
+| 01 00 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 |..a8....i...$..'|
+| 21 a9 28 c0 97 19 09 09 09 09 09 09 09 09 09 09 |!.(.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 21 a9 |a8....i...$..'!.|
+| 28 c0 97 19 |(... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #194 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9c e0 8b 42 4a b9 05 46 ad ff 69 7f 0b c3 4c bf |...BJ..F..i...L.|
+| af be 30 e2 fc 0b 9e 2c 6c d0 9d 07 ea f4 fc 48 |..0....,l......H|
+| 9e e4 f8 34 c8 a8 bd bb fb c2 90 33 f2 78 83 78 |...4.......3.x.x|
+Plaintext[48]:
+| 0a 8b 34 b0 63 e9 d4 58 35 28 31 6b a8 69 1d 4c |..4.c..X5(1k.i.L|
+| 01 00 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a |..Y.8.d.........|
+| 59 35 7c 63 c2 dc 09 09 09 09 09 09 09 09 09 09 |Y5|c............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a 59 35 |Y.8.d.........Y5|
+| 7c 63 c2 dc ||c.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #199 (first time)
+ssl_session_init: initializing ptr 0x7facc382db70 size 688
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35174 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4449
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #201 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 74 a6 ef e0 bc d2 ba 17 49 cc b8 fe d7 c3 f2 |"t.......I......|
+| 01 4f 63 f5 29 9b d4 47 2e 9f db 9d 67 52 34 bf |.Oc.)..G....gR4.|
+| 22 f0 fc 88 02 6c b6 7e 23 6c 61 77 46 7a cc ef |"....l.~#lawFz..|
+| 60 aa fc 47 82 6c 7c 58 87 4b 5f d5 6a |`..G.l|X.K_.j |
+hash out[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+PRF out[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+key expansion[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+Client MAC key[20]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 |.*Q. |
+Server MAC key[20]:
+| 5e 90 18 dd c0 fe dc 76 36 24 25 9b fc 67 17 6a |^......v6$%..g.j|
+| 8f 31 72 da |.1r. |
+Client Write key[16]:
+| 02 3b e7 51 e1 4e f6 c2 11 f7 30 84 0e 70 45 44 |.;.Q.N....0..pED|
+Server Write key[16]:
+| ac 66 a0 8c b3 41 44 26 fa a2 45 07 af 74 fb 7d |.f...AD&..E..t.}|
+Client Write IV[16]:
+| 6c a0 c8 88 b0 09 de 6c 0d ee 53 22 fe 91 78 f9 |l......l..S"..x.|
+Server Write IV[16]:
+| be e3 54 ac 03 24 0d 7b e3 ad bd 37 f8 4c e3 9b |..T..$.{...7.L..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #203 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc4782...
+looking for RSA pre-master0080b9b978bd5956049bf352b112da25a73a33242f9817c7...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 74 a6 ef e0 bc d2 ba 17 49 cc b8 fe d7 c3 f2 |"t.......I......|
+| 01 4f 63 f5 29 9b d4 47 2e 9f db 9d 67 52 34 bf |.Oc.)..G....gR4.|
+| 22 f0 fc 88 02 6c b6 7e 23 6c 61 77 46 7a cc ef |"....l.~#lawFz..|
+| 60 aa fc 47 82 6c 7c 58 87 4b 5f d5 6a |`..G.l|X.K_.j |
+hash out[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+PRF out[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+key expansion[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+Client MAC key[20]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 |...R |
+Server MAC key[20]:
+| b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 53 dc a5 ba |.....(..S:[.S...|
+| c0 49 44 a0 |.ID. |
+Client Write key[16]:
+| 53 f2 f7 ad 6d 66 6e a7 bf ff bc da 68 02 3c f7 |S...mfn.....h.<.|
+Server Write key[16]:
+| d2 d8 6a 60 a7 20 6d 49 de 7f e5 ea ea 22 d6 03 |..j`. mI....."..|
+Client Write IV[16]:
+| d0 a8 3c aa ee b8 a3 c8 fa 52 3d 5e ed 97 c1 30 |..<......R=^...0|
+Server Write IV[16]:
+| 40 5e be ed 08 fb 46 d7 9c a5 39 a0 b8 8d 7a ee |@^....F...9...z.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1a aa 5b 13 c1 e5 c2 55 12 09 6b 60 5b 4a 84 c0 |..[....U..k`[J..|
+| 65 a6 5e 50 3b 45 44 17 49 82 1c ff 91 bd 57 43 |e.^P;ED.I.....WC|
+| 59 e1 34 5b 6c 39 d9 56 c4 07 a7 91 7a 05 0f ff |Y.4[l9.V....z...|
+| 49 b5 78 5d 4f d6 27 87 cb d7 2b 30 92 74 45 89 |I.x]O.'...+0.tE.|
+Plaintext[64]:
+| c9 72 a6 91 af 7b f6 9f 3c 98 45 ae bd 13 51 18 |.r...{..<.E...Q.|
+| 14 00 00 0c 13 88 0e 46 45 6b fe 15 52 62 b0 1c |.......FEk..Rb..|
+| cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..|
+| fc 51 3e 56 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Q>V............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..|
+| fc 51 3e 56 |.Q>V |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #204 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8c cb 3d c7 4b 41 55 a1 6c 88 db a7 f2 7b 12 d6 |..=.KAU.l....{..|
+| f0 76 38 7d ff 01 bd f8 30 b8 1b ba bb ea 91 b6 |.v8}....0.......|
+| 2b 5d c9 7e 3b a7 a4 06 fc f0 6b d9 d1 81 55 56 |+].~;.....k...UV|
+| fe 9a 56 f3 3f dc 01 61 1c 7f 69 a7 6f 9f ce 1a |..V.?..a..i.o...|
+Plaintext[64]:
+| d0 72 3d d9 78 4a 2e 8b 82 8e 64 2c 0a 71 8b 5c |.r=.xJ....d,.q.\|
+| 14 00 00 0c 7b f3 4d d3 23 a2 c1 bc 5f d5 4c 84 |....{.M.#..._.L.|
+| 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@|
+| c5 60 09 e3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.`..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@|
+| c5 60 09 e3 |.`.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #205 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 95 c2 42 13 da cc 84 b5 31 bb cc 7a 2d 8c 3a c5 |..B.....1..z-.:.|
+| 76 da 0f 00 83 0b db 4e 1a 04 b1 27 fc 8c a1 f7 |v......N...'....|
+| 0a be 0e 78 40 18 8a bd 20 cb fe f6 ff d3 9b c2 |...x@... .......|
+| fc 91 7a d5 b3 35 51 02 b9 1a 82 32 80 91 2c d2 |..z..5Q....2..,.|
+| fb f7 a1 e9 32 d2 37 32 73 76 16 29 68 52 7c a9 |....2.72sv.)hR|.|
+| 7a 69 6f eb 7c fc 50 83 5b 5f b5 72 4b b5 69 29 |zio.|.P.[_.rK.i)|
+| f1 25 40 c2 ba b0 41 ef 53 de 28 83 d0 fa 6b f8 |.%@...A.S.(...k.|
+Plaintext[112]:
+| ce 37 c8 32 fa f8 2f 01 1c a4 d7 d2 53 c2 74 73 |.7.2../.....S.ts|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 34 39 0d 0a 0d 0a 72 a0 8f 78 7e a3 57 49 |4449....r..x~.WI|
+| 6b ca 69 7b 19 37 aa d9 ef 6c 18 40 03 03 03 03 |k.i{.7...l.@....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 42 10 d3 40 4f e3 b3 15 17 78 c0 5d 6c 43 17 20 |B..@O....x.]lC. |
+| 5f 43 42 1b |_CB. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35174 found (nil)
+association_find: TCP port 4449 found 0x342ddd0
+
+dissect_ssl enter frame #206 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| f9 c6 ca af d9 57 23 46 a9 cb e8 f7 3d 3b 8f 42 |.....W#F....=;.B|
+| fd 80 9a f0 70 a7 d9 84 9b 04 f5 e3 01 58 d7 88 |....p........X..|
+| 96 50 80 23 a7 7d 9c 7d 14 c9 19 e5 86 be ad b8 |.P.#.}.}........|
+| 86 65 11 e5 79 e2 f4 60 1f b7 fa bd 8f 4e 72 46 |.e..y..`.....NrF|
+| e8 b7 66 e5 09 54 fa 10 ae 96 61 4b 5c b4 3c e3 |..f..T....aK\.<.|
+| b9 35 a4 ef a6 ef c5 0c 81 ad 4b 5b bb 96 6c 0d |.5........K[..l.|
+| 2a 95 67 3c 7b 31 b8 81 e7 06 fc aa 7c 3d 6c 75 |*.g<{1......|=lu|
+| 3c 06 fb ec d6 57 5c 4d 55 14 8e 7e ab db de 54 |<....W\MU..~...T|
+| 7a 5b 60 cd dd b7 35 94 77 b4 ad 99 8b cd 34 97 |z[`...5.w.....4.|
+| c0 bb a9 7a 0d 6f 53 ce 76 8f e8 51 8a 8c dc f8 |...z.oS.v..Q....|
+| 5a b4 86 58 63 0f 91 5e c5 b3 d0 09 6a ca 6a f2 |Z..Xc..^....j.j.|
+| c9 b5 20 83 90 17 d2 7e 88 47 ba 95 89 ec dd 4a |.. ....~.G.....J|
+| d1 c4 cd 4f 22 40 cb 9d 6e 22 59 c6 66 dd 3f 48 |...O"@..n"Y.f.?H|
+| fa cd 37 c9 0a bd 29 8f 9a 70 b2 2a 2a 5d 36 24 |..7...)..p.**]6$|
+| 53 da db 7c 51 1c 93 67 cf a4 b2 db 3e 94 bc f5 |S..|Q..g....>...|
+| 88 be 16 d1 09 da ed 29 a6 ac 5b e5 b8 08 24 32 |.......)..[...$2|
+| 85 58 ae 47 c6 8c 77 e6 28 3a f2 49 00 d1 26 1e |.X.G..w.(:.I..&.|
+| 3e 1d fb 01 d1 cf ac 95 97 04 59 10 91 fb 47 1a |>.........Y...G.|
+| 91 11 fd 85 8d 79 14 56 35 16 66 ad 91 50 c8 3a |.....y.V5.f..P.:|
+| 5e 6c f4 f2 02 6c de a2 d6 cf 48 b3 c3 8f 1b c8 |^l...l....H.....|
+| 49 21 4c 5d 6c 49 49 43 29 88 0c ef 94 a8 d7 60 |I!L]lIIC)......`|
+| cf 72 be 34 54 cb b6 9e f2 c3 e6 d3 56 fc ab 4a |.r.4T.......V..J|
+| 5a f3 46 1d c4 98 ad 96 e4 bf 74 33 6b 74 a5 2e |Z.F.......t3kt..|
+| 28 d9 6e 6e b1 c1 7f e3 a1 d7 24 9c 0c 75 a7 fc |(.nn......$..u..|
+| 9c 74 64 3d fc 29 55 85 1b 6d fc ce df f3 98 44 |.td=.)U..m.....D|
+Plaintext[400]:
+| 8c 98 a2 4f 4b 5e c6 7b da 49 3c ff 53 de d6 70 |...OK^.{.I<.S..p|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D|
+| 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e be 07 e7 8d |nl'</script>....|
+| d4 2c d0 de 99 91 8d 2d a9 fe df a6 6b 27 96 3e |.,.....-....k'.>|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 57 0f 53 9a 8b 11 3b 7d fe 4c 8a 99 10 4f e4 |yW.S...;}.L...O.|
+| f8 1c 52 00 |..R. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4449 found 0x342ddd0
+
+dissect_ssl enter frame #207 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| cc 91 6e 69 2b ad f6 5d 0f 4c 48 28 a3 cb 08 c4 |..ni+..].LH(....|
+| 96 35 79 19 88 e9 4a f8 85 ef f6 73 b9 ff b7 41 |.5y...J....s...A|
+| 1c 8f 19 66 77 97 2b 8f 51 44 1b de ce ee 0c e3 |...fw.+.QD......|
+Plaintext[48]:
+| 72 0d d0 89 07 ec 22 1c c3 7a f4 20 15 8c 15 20 |r....."..z. ... |
+| 01 00 d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 |......l.<..q..Us|
+| 2a 4c 83 f1 9f 36 09 09 09 09 09 09 09 09 09 09 |*L...6..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 2a 4c |....l.<..q..Us*L|
+| 83 f1 9f 36 |...6 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #209 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 90 aa ba 12 d1 e9 9a 9d aa 5a cd 26 66 dc ac 01 |.........Z.&f...|
+| 39 9f a1 98 a5 ec 81 97 7d 87 5a 9e 8e 58 c1 4d |9.......}.Z..X.M|
+| 21 80 07 64 7d 28 ac d2 f5 c9 51 98 2b b3 36 fb |!..d}(....Q.+.6.|
+Plaintext[48]:
+| 4a 36 7b 03 9d a9 ed 83 0e 67 07 9f e4 8b 7c ae |J6{......g....|.|
+| 01 00 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d |..S.g.......6E..|
+| 59 f6 a7 97 a5 d5 09 09 09 09 09 09 09 09 09 09 |Y...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d 59 f6 |S.g.......6E..Y.|
+| a7 97 a5 d5 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #214 (first time)
+ssl_session_init: initializing ptr 0x7facc3830070 size 688
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53394 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4450
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #216 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..|
+| 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.|
+| 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...|
+| 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... |
+hash out[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+PRF out[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+key expansion[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+Client MAC key[20]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd |..^. |
+Server MAC key[20]:
+| 95 7c f3 a1 7a aa e2 18 7c 14 5d eb 44 de 1a 0e |.|..z...|.].D...|
+| 8a 57 0f 31 |.W.1 |
+Client Write key[16]:
+| 11 18 c5 bf 7e 5f bb 80 77 75 fd 33 6b 6e 72 b1 |....~_..wu.3knr.|
+Server Write key[16]:
+| 07 70 86 4b b1 1b 9b ae 7b da 46 f1 ee c2 e8 8f |.p.K....{.F.....|
+Client Write IV[16]:
+| 40 64 89 a4 db 02 a5 98 ec 83 72 a5 bb 31 a1 f2 |@d........r..1..|
+Server Write IV[16]:
+| 93 d5 7f 76 99 ec f0 49 4f 34 55 ac 31 de 9b 4e |...v...IO4U.1..N|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #218 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91ae...
+looking for RSA pre-master008098036d78af04b0df0adf81fd3d92912cfb41a1fd72f7...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..|
+| 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.|
+| 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...|
+| 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... |
+hash out[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+PRF out[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+key expansion[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+Client MAC key[20]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 |..0. |
+Server MAC key[20]:
+| ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a 28 58 15 6a |..u6....s...(X.j|
+| c9 8d a4 90 |.... |
+Client Write key[16]:
+| b2 d6 70 be b2 30 1a c6 4e d8 15 e0 d6 67 b7 8c |..p..0..N....g..|
+Server Write key[16]:
+| 4d 85 e0 53 35 84 95 4e 73 10 4d 3f 4a fc 2e ae |M..S5..Ns.M?J...|
+Client Write IV[16]:
+| c5 ae 50 0f f8 b1 f9 10 cc cd 68 1a 7f e7 09 5a |..P.......h....Z|
+Server Write IV[16]:
+| e0 00 51 bf 15 2b 12 bf f4 d3 a8 8e ab 53 46 db |..Q..+.......SF.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| da 1e 53 71 13 06 e0 4d 50 f4 f5 1e 8f 8b 4f 61 |..Sq...MP.....Oa|
+| a3 c6 75 18 d0 87 99 db 1a 5f 08 a9 b6 e9 f6 43 |..u......_.....C|
+| d9 d4 ef f2 73 f9 06 10 90 2c 8a a1 fe b9 48 b1 |....s....,....H.|
+| 36 48 2d 85 db b2 03 6a 22 30 bd d6 56 24 ea f5 |6H-....j"0..V$..|
+Plaintext[64]:
+| 34 6c 1c 72 2e c6 f9 f4 7b d1 c7 4c ce ac 42 0d |4l.r....{..L..B.|
+| 14 00 00 0c 62 68 8e 07 e3 e9 87 c4 64 4c ae 96 |....bh......dL..|
+| 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....|
+| 01 e1 50 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..P?............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....|
+| 01 e1 50 3f |..P? |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #219 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| de 04 09 48 bb 04 88 66 86 4f 28 a4 c4 98 58 02 |...H...f.O(...X.|
+| 3d 86 95 4a 9c a3 45 1e eb c4 27 9d 85 9a d6 b0 |=..J..E...'.....|
+| 4e cf c3 04 7d c0 1d 1a a1 0d e2 9f 72 a6 fa bb |N...}.......r...|
+| fe 60 f0 63 53 11 d6 bb a7 5d b4 be d7 dd ae 10 |.`.cS....]......|
+Plaintext[64]:
+| 60 fc 5d e4 11 09 ef 6f 85 b6 6e cd 0c a9 70 db |`.]....o..n...p.|
+| 14 00 00 0c a3 db ba fd 9c b7 bc e4 1d c6 6b ac |..............k.|
+| 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.|
+| c6 6d 9d 76 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.m.v............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.|
+| c6 6d 9d 76 |.m.v |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #220 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| f6 fe b7 9f c5 71 d6 09 31 21 97 31 71 2c ea 1e |.....q..1!.1q,..|
+| 46 d6 3b 94 19 f7 62 c3 5d 89 ee 1e aa e5 c8 03 |F.;...b.].......|
+| 3d 14 f5 36 4b 67 ef 79 fc 5b b5 e1 c2 0d eb bf |=..6Kg.y.[......|
+| 81 b3 9c 38 bb 8f af 7c 1c a2 06 de 1e 33 47 9a |...8...|.....3G.|
+| 3d ce d8 f7 ea f1 ff dc 88 76 b0 90 0c 46 8d bc |=........v...F..|
+| 7e c3 a1 5f 7c 0a 39 1d b2 07 ec 63 aa 66 d8 59 |~.._|.9....c.f.Y|
+| bf fb 7f 05 77 51 19 59 2d 4b aa 53 93 dd f6 73 |....wQ.Y-K.S...s|
+Plaintext[112]:
+| da bc 75 e8 e2 36 3a 4a 75 2d 01 cf ba 6a 95 58 |..u..6:Ju-...j.X|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 30 0d 0a 0d 0a 77 96 c7 8d e2 d2 15 e5 |4450....w.......|
+| 2d 77 c1 73 5e b2 37 5c d6 98 c4 28 03 03 03 03 |-w.s^.7\...(....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8b 17 28 9f f4 2e cf 5e f1 f4 29 db e2 ea b8 33 |..(....^..)....3|
+| fa d1 e7 58 |...X |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53394 found (nil)
+association_find: TCP port 4450 found 0x342de60
+
+dissect_ssl enter frame #221 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 85 90 11 f6 15 d2 7c 8b 27 50 90 40 d2 e9 4b 86 |......|.'P.@..K.|
+| f8 40 92 7b e3 cc fb b5 e6 75 61 61 fb a4 1f a0 |.@.{.....uaa....|
+| 44 8a be c2 f5 10 41 8b 53 81 8c 69 01 13 14 b5 |D.....A.S..i....|
+| d8 eb 77 35 e1 5c 9f 07 11 af 60 6e b3 55 55 e6 |..w5.\....`n.UU.|
+| 4d e4 6e ba 2c a9 ee 82 29 11 7c 94 94 e6 00 da |M.n.,...).|.....|
+| 4d 31 7e f8 1e 75 78 8d c4 dd 2b 39 eb 87 0b 6a |M1~..ux...+9...j|
+| 76 a1 5d aa 5f 30 b9 ef a7 61 95 74 f9 2c a0 0f |v.]._0...a.t.,..|
+| f3 ca b7 b1 55 6b d5 7d 4b 9d 15 48 c7 03 92 c8 |....Uk.}K..H....|
+| 2a 47 a4 fa c5 90 2a 19 df d4 e8 1b 21 6f 4f f5 |*G....*.....!oO.|
+| fc 75 01 57 94 d6 24 ae ba d2 56 99 16 ef f2 43 |.u.W..$...V....C|
+| ad c6 c2 fe ad 7b cf b2 30 1d ab 4c 1e 7b 01 d0 |.....{..0..L.{..|
+| f7 d7 d4 dd 0d 9d 3b a5 77 43 b3 f2 92 41 0f bc |......;.wC...A..|
+| 5c be c8 55 ee 53 2a cb 79 12 de b2 8b 95 9e f3 |\..U.S*.y.......|
+| cd c0 f4 1a a4 ad be 94 30 00 c0 fd 0f 34 c5 a8 |........0....4..|
+| 36 ea b8 f2 33 af 2e 5e 1e c4 45 30 59 22 db a3 |6...3..^..E0Y"..|
+| 75 da 27 c9 c1 6e 99 73 83 db 49 00 44 9e 81 7a |u.'..n.s..I.D..z|
+| b2 b4 55 6d 4d ba d6 08 c2 61 41 f4 76 ab c2 dd |..UmM....aA.v...|
+| 2a 32 a4 49 82 12 f3 43 eb 94 22 56 2a 12 78 a1 |*2.I...C.."V*.x.|
+| 38 ab fb c8 fb 7c 9d f6 15 62 e2 98 d8 e9 14 0d |8....|...b......|
+| ab 0a d6 dd db 7f cc 92 81 ab fb 36 3d 32 64 a5 |...........6=2d.|
+| a0 d4 99 4f c2 d9 5e 2a 69 80 ab 9f 3b 2c 69 2f |...O..^*i...;,i/|
+| eb 9b fc dd a4 b1 51 eb f8 cd fd 82 2d 12 cf 3f |......Q.....-..?|
+| db c5 ec af 29 2f 89 6e 84 1b f3 81 7e b5 42 0c |....)/.n....~.B.|
+| 28 d4 48 8a 56 ad 0a cb 53 1c 11 f7 dd 17 f5 33 |(.H.V...S......3|
+| ca 61 bb 25 e1 17 d4 54 be 6a 35 9d 06 61 3e c1 |.a.%...T.j5..a>.|
+Plaintext[400]:
+| 0d cd 43 22 4e ee 0e 02 2d 1a 62 80 89 7a 97 9b |..C"N...-.b..z..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R|
+| 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9a 78 5d db |nl'</script>.x].|
+| f5 ae 76 de ee 26 9b b1 fb df b3 42 94 8f 67 67 |..v..&.....B..gg|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bc 41 56 7d 9e 88 34 95 b0 3d 51 2b ad 81 89 3b |.AV}..4..=Q+...;|
+| 6f 02 89 b2 |o... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4450 found 0x342de60
+
+dissect_ssl enter frame #222 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 56 07 e5 3d a8 e5 e2 b7 82 32 98 51 b0 cd db 92 |V..=.....2.Q....|
+| 2e 71 94 4f 2c 50 48 f5 7c 00 e3 d6 53 ac ce 61 |.q.O,PH.|...S..a|
+| 32 c9 92 6a 9f 88 8e 81 0a fe 83 86 70 9b 87 4f |2..j........p..O|
+Plaintext[48]:
+| 6d fa 5a c7 06 29 98 f9 67 3a 23 41 64 47 1a b1 |m.Z..)..g:#AdG..|
+| 01 00 e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a |........3..$[49:|
+| 9e de e2 14 20 24 09 09 09 09 09 09 09 09 09 09 |.... $..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a 9e de |......3..$[49:..|
+| e2 14 20 24 |.. $ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #224 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 67 87 bf 08 17 6d a5 3e 16 71 61 9c ca bb 8c 3e |g....m.>.qa....>|
+| e7 99 6f c3 8d 4b 94 e7 db 4d e8 d0 17 c8 ce fe |..o..K...M......|
+| 00 aa ed e8 69 4a 6c ff a6 1e 58 e6 86 04 27 33 |....iJl...X...'3|
+Plaintext[48]:
+| c6 1e 1e 46 38 d7 d1 db 27 a5 9b bf 8d a9 61 08 |...F8...'.....a.|
+| 01 00 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 |..3...V\......q.|
+| 18 63 43 5f 7c 01 09 09 09 09 09 09 09 09 09 09 |.cC_|...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 18 63 |3...V\......q..c|
+| 43 5f 7c 01 |C_|. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #229 (first time)
+ssl_session_init: initializing ptr 0x7facc3832570 size 688
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45991 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4451
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #231 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+|
+| 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.|
+| 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*|
+| 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. |
+hash out[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+PRF out[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+key expansion[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+Client MAC key[20]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec |..<. |
+Server MAC key[20]:
+| 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd fe 19 46 0c |+x....v.e.....F.|
+| ef 8b e8 ad |.... |
+Client Write key[32]:
+| 7c 4f 97 74 31 57 f5 57 56 47 bc ef 4c c7 33 8e ||O.t1W.WVG..L.3.|
+| 92 f0 b6 6a 3b c7 ea 55 a8 aa 22 d0 26 cf 0c 08 |...j;..U..".&...|
+Server Write key[32]:
+| 01 13 48 92 c8 21 0a eb f9 8e 71 e5 1e 7d 6f 45 |..H..!....q..}oE|
+| 07 69 f9 2e 7e 6e 07 a4 f7 64 2e 37 7c 5f b3 c8 |.i..~n...d.7|_..|
+Client Write IV[16]:
+| ff 79 6e c4 8c 8b 77 88 af 92 1c 13 83 9c 43 75 |.yn...w.......Cu|
+Server Write IV[16]:
+| 3a ca a7 e2 49 a7 0b bb 52 f0 f8 09 aa 19 a5 43 |:...I...R......C|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #233 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a09...
+looking for RSA pre-master7c97fd12116f5cd9318ea3c2fd49a66dedcd1c3dd6580709...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+|
+| 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.|
+| 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*|
+| 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. |
+hash out[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+PRF out[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+key expansion[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+Client MAC key[20]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 |.-.6 |
+Server MAC key[20]:
+| 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c 8f 11 5c bb |9..#(..k.V.\..\.|
+| 27 8a 75 ae |'.u. |
+Client Write key[32]:
+| e5 21 ca ce 1b 2f 90 38 07 16 01 63 3c 91 ab 4a |.!.../.8...c<..J|
+| c4 82 b4 46 82 8b cc e2 53 21 62 af d0 8f aa fe |...F....S!b.....|
+Server Write key[32]:
+| 36 ba 16 c9 7b e9 2a b7 b7 80 d1 e2 1d 93 5f 44 |6...{.*......._D|
+| 79 a9 9e 3e 68 5c 89 3e cc 50 32 89 15 d4 99 26 |y..>h\.>.P2....&|
+Client Write IV[16]:
+| 08 c5 c8 26 75 f7 2a ed 24 ba 5f 03 57 b4 69 ba |...&u.*.$._.W.i.|
+Server Write IV[16]:
+| 0f 9d 74 ea d4 46 bb 51 6a b3 10 38 53 5b df 4d |..t..F.Qj..8S[.M|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8c 5f 0e c2 4f 0d dc 70 fa 81 64 3a 7f df 6f 8a |._..O..p..d:..o.|
+| 65 73 62 2a 29 20 d4 c0 f1 da c9 6f 5a 2a 28 4e |esb*) .....oZ*(N|
+| 73 01 d3 3c 23 a0 8d ce ac df 8a 15 6b 27 40 ff |s..<#.......k'@.|
+| fe 10 b0 d9 e2 d1 87 33 8c 11 84 4b 4b d2 5e a1 |.......3...KK.^.|
+Plaintext[64]:
+| a3 e6 4c 96 5b 0a db 17 31 13 95 cc f2 bc b5 d5 |..L.[...1.......|
+| 14 00 00 0c a8 bd 4b 1c 45 58 96 01 31 fc b9 72 |......K.EX..1..r|
+| 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....|
+| a7 59 ff 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Y.5............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....|
+| a7 59 ff 35 |.Y.5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #234 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| dc 75 bf d7 50 2f 48 80 b7 82 c3 2c 9b 6f f2 e3 |.u..P/H....,.o..|
+| 24 9f d6 90 8c 41 02 9c 33 6f 04 3e 10 a2 f2 90 |$....A..3o.>....|
+| 2a 2b ed 75 f9 3e 2f 17 4f 4b 72 fc ee 11 ce cc |*+.u.>/.OKr.....|
+| 8c b0 3a 57 7e aa 79 2b 34 bc 75 2a ff 0c 3f 21 |..:W~.y+4.u*..?!|
+Plaintext[64]:
+| a9 ff 4a 61 99 33 93 3c ee 55 f2 51 a6 1e 53 9c |..Ja.3.<.U.Q..S.|
+| 14 00 00 0c ff 37 53 48 fe fb 5f ef 96 28 b4 62 |.....7SH.._..(.b|
+| 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w|
+| 62 e4 e4 d8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |b...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w|
+| 62 e4 e4 d8 |b... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #235 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a9 ac 77 6a b9 49 cc 01 9e 99 52 80 0d c3 cd a9 |..wj.I....R.....|
+| d5 fe 73 b5 08 3b 39 9b 74 b2 db 0d 27 96 03 fa |..s..;9.t...'...|
+| e0 9e 07 37 fc 80 21 9b 6d bc d0 8a d2 8e d0 fb |...7..!.m.......|
+| c4 9a 33 3f be 1b 78 37 c9 fd cb 10 b7 85 26 12 |..3?..x7......&.|
+| 0a 72 19 84 27 7e fa 65 35 0c be 30 eb 96 eb c5 |.r..'~.e5..0....|
+| 8f 6e b2 72 84 89 d3 ef 1e 28 43 7d 7d f1 65 25 |.n.r.....(C}}.e%|
+| 44 fe 89 21 bb 84 11 ec 90 c8 43 d1 8b cf 49 3d |D..!......C...I=|
+Plaintext[112]:
+| 0d dc fe 87 9e 66 d3 86 a2 96 4e 92 2f e1 8f 4e |.....f....N./..N|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....|
+| 55 00 17 d7 9e 89 64 21 f1 d5 16 e3 54 8a a1 72 |U.....d!....T..r|
+| 6d ea 4e 84 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m.N.............|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 c7 49 3c 3f 3f 62 74 b0 97 4b 0c d1 15 9d 50 |3.I<??bt..K....P|
+| 9d f6 31 64 |..1d |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45991 found (nil)
+association_find: TCP port 4451 found 0x3424dc0
+
+dissect_ssl enter frame #236 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e1 4b 6e 39 13 f9 49 04 59 41 e0 f6 2a 8d 8c 36 |.Kn9..I.YA..*..6|
+| f6 34 82 31 f5 67 82 d1 f0 bf e8 2d 9d e2 96 24 |.4.1.g.....-...$|
+| e7 86 60 83 94 e0 7a d9 36 91 36 88 52 3a b7 b4 |..`...z.6.6.R:..|
+| 3f 9a 3f ce 7c 5d 7d d8 ae 73 74 72 6b 3f a4 04 |?.?.|]}..strk?..|
+| 95 28 1c af 38 82 84 2c 64 2d cc dc 32 10 78 d9 |.(..8..,d-..2.x.|
+| 02 90 bc 6a ce 5b 70 8c 61 4b d1 57 31 c2 e2 47 |...j.[p.aK.W1..G|
+| 07 36 ff 73 0f f9 cb 68 74 2d 42 41 b3 ab b7 97 |.6.s...ht-BA....|
+| 8c fe 86 b2 60 96 11 94 08 44 fc 8f 03 87 7d 23 |....`....D....}#|
+| ad e9 e0 10 21 2b a6 f8 ac 63 b9 0d 0b bd 63 3a |....!+...c....c:|
+| 22 2b 75 7e 9b 69 ff 79 e6 aa 7c 5a 1c 81 db c4 |"+u~.i.y..|Z....|
+| bc 75 27 d1 53 cb 63 fe b4 2a c1 2c 82 d0 ee 4c |.u'.S.c..*.,...L|
+| 16 40 0f e0 88 c7 34 43 2b 8e 64 ae bd fa 5a 36 |.@....4C+.d...Z6|
+| 15 b6 3f 5a 8a 99 f6 68 eb a9 b5 3a 5d 79 cf a5 |..?Z...h...:]y..|
+| 93 11 09 69 69 0c cf ff cc 17 e7 3a 3e 88 34 9e |...ii......:>.4.|
+| a3 98 c3 d0 5d dc e6 5f 31 12 64 76 f8 66 1d da |....].._1.dv.f..|
+| d0 e5 61 fd ef fd b4 b2 0e ff 6f 19 12 ab 8c f5 |..a.......o.....|
+| ba 63 97 50 d7 f4 34 63 9b be aa 7e 18 9b 8b f7 |.c.P..4c...~....|
+| 49 5a 73 bf 30 e2 6f 78 fb c4 fb 32 60 dc 0a 48 |IZs.0.ox...2`..H|
+| bb a5 64 17 43 25 37 70 dc 95 21 64 6d f4 41 48 |..d.C%7p..!dm.AH|
+| 66 c7 0b 01 cd d6 8b 40 96 63 16 52 64 53 84 38 |f......@.c.RdS.8|
+| 94 15 bc 95 a9 c0 00 2f a3 22 89 bf d0 da 89 02 |......./."......|
+| 7d de a7 cc 6c 1e c9 e2 18 1e 9d 79 0b ce fe 8c |}...l......y....|
+| da c7 74 e9 8a 14 f4 3e 64 bf 70 e2 5b 53 d1 92 |..t....>d.p.[S..|
+| 4c e9 a0 2b a5 ce 4c a3 e7 72 be 63 08 6c 4f 58 |L..+..L..r.c.lOX|
+| 2e 94 3a 8a 7b 92 f7 46 aa 47 e4 28 16 12 27 68 |..:.{..F.G.(..'h|
+Plaintext[400]:
+| fe 07 3e 92 d3 80 72 af 82 76 8c 41 23 45 c9 c5 |..>...r..v.A#E..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25|
+| 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e a2 05 fa 23 |nl'</script>...#|
+| a0 00 9c 53 8c 7e d3 dc 68 98 1b da 1b ec 58 43 |...S.~..h.....XC|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f9 f1 83 ba 77 40 95 49 8e 20 1e 75 be 14 e2 8c |....w@.I. .u....|
+| 6c 49 99 07 |lI.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4451 found 0x3424dc0
+
+dissect_ssl enter frame #237 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 78 26 87 b1 f9 e8 f1 33 20 91 34 02 00 78 4e 4a |x&.....3 .4..xNJ|
+| 91 3b 8b 17 91 de b0 cc fa c2 8c f5 1d 82 d1 a8 |.;..............|
+| d0 af b1 ba 6d a1 73 0f 51 f1 50 57 1c 94 6c 10 |....m.s.Q.PW..l.|
+Plaintext[48]:
+| 12 ec 43 b7 63 d8 9e 38 e7 c1 31 50 b9 22 a8 d3 |..C.c..8..1P."..|
+| 01 00 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f |..e...dV9@.%.k$/|
+| 1f b8 98 da 0f 76 09 09 09 09 09 09 09 09 09 09 |.....v..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f 1f b8 |e...dV9@.%.k$/..|
+| 98 da 0f 76 |...v |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #239 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4b e0 4c ca 1b c6 2a 79 38 d1 eb a9 fb 86 98 7f |K.L...*y8.......|
+| e0 a4 2a 34 60 a5 ba 3f c6 89 b6 d7 bc 61 48 f5 |..*4`..?.....aH.|
+| 05 bb e3 ea 75 ed 5d c8 a4 a0 38 68 62 d4 54 97 |....u.]...8hb.T.|
+Plaintext[48]:
+| d4 72 5e 93 4c 53 89 73 09 a8 0b 04 14 8d 12 c6 |.r^.LS.s........|
+| 01 00 cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 |....v...........|
+| a5 bf 7f 45 a1 19 09 09 09 09 09 09 09 09 09 09 |...E............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 a5 bf |..v.............|
+| 7f 45 a1 19 |.E.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #244 (first time)
+ssl_session_init: initializing ptr 0x7facc3834af0 size 688
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44935 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4452
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #246 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u|
+| 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.|
+| 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm|
+| 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... |
+hash out[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+PRF out[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+key expansion[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+Client MAC key[20]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 |C... |
+Server MAC key[20]:
+| 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 14 49 c8 c0 |O...?.fzt.B8.I..|
+| 63 b9 78 f6 |c.x. |
+Client Write key[32]:
+| 55 5b 32 fb 0f ef b9 7f 7c bd 10 ac 89 e5 16 75 |U[2.....|......u|
+| 27 f9 e6 ad 8a f4 07 f7 6c 2b e5 05 03 31 97 b6 |'.......l+...1..|
+Server Write key[32]:
+| 41 72 d3 2e 3c df 70 8d 57 a6 03 68 34 99 3e d8 |Ar..<.p.W..h4.>.|
+| d2 14 58 b2 0a 86 40 30 0a 11 4f ad 47 1c 23 33 |..X...@0..O.G.#3|
+Client Write IV[16]:
+| 7e a1 39 52 d0 fc 07 16 32 8a 8e 80 81 aa 11 15 |~.9R....2.......|
+Server Write IV[16]:
+| a0 89 d6 b5 2a 6c 8c 91 27 4b be af 69 fb 6e 33 |....*l..'K..i.n3|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #248 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a...
+looking for RSA pre-master0080a7f168aa7ed7d19030f70c424cdc8441875d8e56e5f3...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u|
+| 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.|
+| 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm|
+| 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... |
+hash out[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+PRF out[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+key expansion[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+Client MAC key[20]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d |.."] |
+Server MAC key[20]:
+| 88 89 c5 ed a4 f0 72 06 ab 12 60 68 31 73 9a f6 |......r...`h1s..|
+| b7 1c b6 2b |...+ |
+Client Write key[32]:
+| 48 f1 89 95 81 bd ea d9 9b 62 1b f9 ea df c6 d3 |H........b......|
+| 7b 90 77 29 6f 4e 56 52 b7 98 d8 22 73 e7 34 40 |{.w)oNVR..."s.4@|
+Server Write key[32]:
+| 1f 91 c7 68 07 5d 1c e5 ba 67 36 80 83 17 42 1d |...h.]...g6...B.|
+| c8 aa d8 87 07 86 60 64 a7 ef de cc f0 96 02 06 |......`d........|
+Client Write IV[16]:
+| 4f 23 f4 a5 d5 d3 d9 32 40 78 25 1a 10 07 55 1f |O#.....2@x%...U.|
+Server Write IV[16]:
+| 4d 90 9a f2 c1 2f fd ad 5c 6c 71 bc d6 2b 87 8f |M..../..\lq..+..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 75 ec a8 08 8d 09 8e 87 a8 98 7b 51 25 1b ae 82 |u.........{Q%...|
+| e2 a6 b2 5d f6 32 6b fe f8 ac 26 ac c4 56 31 11 |...].2k...&..V1.|
+| 39 84 98 44 2b d7 5d b6 fa 69 c1 d4 6b cb 3d c0 |9..D+.]..i..k.=.|
+| d8 6b 33 b8 44 82 ea 29 a3 c4 c1 97 5c 3f 29 9a |.k3.D..)....\?).|
+Plaintext[64]:
+| 7c 31 75 5d eb 2c ae f4 03 be 09 1e 27 1e 34 a1 ||1u].,......'.4.|
+| 14 00 00 0c 4c 70 79 30 7d 62 93 b9 aa a7 5f 06 |....Lpy0}b...._.|
+| 4e d4 1c 57 83 4a 6d 82 1c 29 30 cc 8d 7b 32 0e |N..W.Jm..)0..{2.|
+| 39 a5 e0 81 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |9...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e d4 1c 57 83 4a 6d 82 1c 29 30 cc 8d 7b 32 0e |N..W.Jm..)0..{2.|
+| 39 a5 e0 81 |9... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #249 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 38 2e 86 e7 be b4 97 c9 14 35 55 8e 1a 55 5b 09 |8........5U..U[.|
+| 22 5d 71 76 41 ce 1e fe 5f 63 3d 29 75 b3 7b 4f |"]qvA..._c=)u.{O|
+| 23 90 a1 7a f2 19 20 db 1f 3b 6f c6 6b 8c f8 47 |#..z.. ..;o.k..G|
+| 71 29 3d 42 b4 f5 17 2e 49 c5 e8 5e e5 a9 62 2e |q)=B....I..^..b.|
+Plaintext[64]:
+| 3f 01 11 a1 3f 61 78 54 aa 7c b8 be 12 da fb 02 |?...?axT.|......|
+| 14 00 00 0c e4 9f 8d b2 d5 96 3c c5 43 84 29 fc |..........<.C.).|
+| 01 ef 6e ca 80 60 7a cb 37 97 ca 54 95 a4 f3 6f |..n..`z.7..T...o|
+| 6e fd c9 e5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |n...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 01 ef 6e ca 80 60 7a cb 37 97 ca 54 95 a4 f3 6f |..n..`z.7..T...o|
+| 6e fd c9 e5 |n... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #250 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a7 d1 79 03 e0 60 6c 8b 88 f0 09 db 2f 23 16 25 |..y..`l...../#.%|
+| e4 84 0d b2 8a 6a d3 e0 b6 aa be 5f 1c f4 b7 8c |.....j....._....|
+| ec e5 6a 55 39 4c fc 25 05 da e9 e4 d1 14 bf a2 |..jU9L.%........|
+| 0d f9 6e 1a a1 96 ea 3f 51 6f b9 74 ba b3 d3 2b |..n....?Qo.t...+|
+| a3 ff d5 73 53 b9 d9 14 a4 d5 13 23 56 17 3c d4 |...sS......#V.<.|
+| 88 e3 50 a6 e2 fd 32 36 2b e7 3a c1 09 b8 3b 4f |..P...26+.:...;O|
+| 72 8d 0f c7 f3 05 be 1f a6 4b f5 6f d5 b3 0d 9f |r........K.o....|
+Plaintext[112]:
+| f9 72 0c c3 30 cc 1a 85 4e ab 61 7c d0 1b 23 18 |.r..0...N.a|..#.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 32 0d 0a 0d 0a d7 a0 6a fb 98 3c ab 7d |4452......j..<.}|
+| 58 18 26 01 f1 a9 46 5f f5 22 9e 3a 03 03 03 03 |X.&...F_.".:....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e f2 5c ad ee da 26 50 45 65 0a 80 cc 99 2f fd |>.\...&PEe..../.|
+| e3 76 ab 8f |.v.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44935 found (nil)
+association_find: TCP port 4452 found 0x3425580
+
+dissect_ssl enter frame #251 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 07 25 c2 b9 e3 c5 07 31 5d 7e 76 d2 35 df a7 27 |.%.....1]~v.5..'|
+| 79 f5 62 56 fa 8e 9b 7e 73 03 c1 b0 15 55 5e 39 |y.bV...~s....U^9|
+| 38 3b 16 78 a1 88 da fe 33 48 6e ac df 30 34 ce |8;.x....3Hn..04.|
+| 18 b2 c4 83 4a b0 e6 67 2e 20 2a d9 25 75 fb 17 |....J..g. *.%u..|
+| 85 ea 08 af 6f 3d ae cd e4 50 a2 e1 d5 0a 59 c3 |....o=...P....Y.|
+| c8 3d af e6 1d 70 eb 6f 41 ca 32 57 a6 53 f4 86 |.=...p.oA.2W.S..|
+| 4b 7f ae 77 55 cc 68 c2 cb 22 e0 4a 13 d8 e8 dc |K..wU.h..".J....|
+| d4 95 63 8c 69 19 91 94 48 da f7 65 3c ed b5 03 |..c.i...H..e<...|
+| 86 c6 fc e0 6c fb b0 70 85 9e e7 14 aa ed dc 49 |....l..p.......I|
+| 61 75 88 ff 72 a1 2c 6e 69 47 5d 92 2e 0a 9e 0a |au..r.,niG].....|
+| fb a1 da e5 d4 9c 36 a0 3b 8d 23 2c 12 68 a2 85 |......6.;.#,.h..|
+| 02 b5 99 26 9a 66 9b c0 01 1b 8b a6 e5 13 94 88 |...&.f..........|
+| 0a 75 fa 61 8d da e0 a9 41 47 a3 0e 2b 18 f2 2f |.u.a....AG..+../|
+| c8 93 2f 68 99 37 8d 72 bc 99 ab e9 df 80 55 ba |../h.7.r......U.|
+| 05 14 dd ba 41 b2 66 a5 8a 24 f5 99 2b f3 c9 8f |....A.f..$..+...|
+| 4b 45 d3 0c 55 2b 6e a3 93 7b 0a db 96 86 34 7f |KE..U+n..{....4.|
+| 37 bc 50 d8 15 34 47 61 9c 75 af a8 5b 5d ab 5b |7.P..4Ga.u..[].[|
+| 1e cb 9a 04 49 e6 3b 53 12 fa 21 25 7d b9 2f 68 |....I.;S..!%}./h|
+| da ae 3a e5 20 8b d6 49 47 ca c9 45 c4 3b 9f 9c |..:. ..IG..E.;..|
+| 43 c0 01 9f 8f 11 39 b1 5a 3c 89 2e de 09 4e 65 |C.....9.Z<....Ne|
+| ce aa d4 4b 4b 02 8a a5 3a 0d 68 20 8c 09 22 b6 |...KK...:.h ..".|
+| 92 67 d5 74 03 10 63 4d 15 6d a0 ed fa 5c 55 bc |.g.t..cM.m...\U.|
+| da ea 35 05 44 7e 28 36 1a 0c d7 8e 73 2c 25 de |..5.D~(6....s,%.|
+| ec 81 ff 06 5a 4a 82 de 08 5a 80 93 91 75 e0 fd |....ZJ...Z...u..|
+| c3 67 a5 ce 08 43 a4 db ce 1d 09 78 6f 87 a7 96 |.g...C.....xo...|
+Plaintext[400]:
+| 3e 38 79 cc e8 37 06 2d 17 6a 2d 3d b3 bf 24 46 |>8y..7.-.j-=..$F|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D|
+| 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 81 6e 9d ae |nl'</script>.n..|
+| 14 ca ec 62 1a b2 1a a6 a0 62 21 bc 50 63 81 16 |...b.....b!.Pc..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 14 66 d1 03 82 dd 26 c5 2f 30 f1 f2 86 8e e5 82 |.f....&./0......|
+| 30 1e 81 e9 |0... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4452 found 0x3425580
+
+dissect_ssl enter frame #252 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f6 4a 3f 4c 1d d6 d3 2c fe 8e 4f 8f 4c 31 52 5e |.J?L...,..O.L1R^|
+| 8a 53 bb 66 b4 2c 1b a2 f9 56 3c e5 68 8e 88 25 |.S.f.,...V<.h..%|
+| be 47 a4 bc f0 e4 99 61 67 03 50 f6 d5 8b 2c c1 |.G.....ag.P...,.|
+Plaintext[48]:
+| 08 4c cf cb 75 b3 56 cb 0f c5 f9 44 13 87 bd 8c |.L..u.V....D....|
+| 01 00 b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e |.....M...l.%....|
+| 85 f6 67 9a 38 75 09 09 09 09 09 09 09 09 09 09 |..g.8u..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e 85 f6 |...M...l.%......|
+| 67 9a 38 75 |g.8u |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #254 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9a 35 0b d6 e7 5b 20 4c 59 dd 07 48 cb b1 49 6f |.5...[ LY..H..Io|
+| 54 bc fd 71 99 d8 f6 92 5b 7f 0f 1a b7 8d c3 4b |T..q....[......K|
+| bd d3 84 e0 95 dc 0d e2 3f 86 8d 69 f5 5a 82 59 |........?..i.Z.Y|
+Plaintext[48]:
+| 51 02 c2 5e ff 54 55 ff de 55 11 c8 1d 7c 9a 09 |Q..^.TU..U...|..|
+| 01 00 f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 |.....Y..u8.|<.KA|
+| e9 91 92 e7 fa 51 09 09 09 09 09 09 09 09 09 09 |.....Q..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 e9 91 |...Y..u8.|<.KA..|
+| 92 e7 fa 51 |...Q |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #259 (first time)
+ssl_session_init: initializing ptr 0x7facc3837030 size 688
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52817 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4453
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #261 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..|
+| 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.|
+| 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*|
+| 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... |
+hash out[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+PRF out[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+key expansion[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+Client MAC key[20]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 |.Y.. |
+Server MAC key[20]:
+| 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 22 37 8a 74 |.....W...u.'"7.t|
+| 37 cd 58 77 |7.Xw |
+Client Write key[32]:
+| cd da 50 dd 9f c1 25 35 ee c7 62 fd 60 b0 42 53 |..P...%5..b.`.BS|
+| 51 25 4d 1e f5 53 0b 9f db f1 9c fd 5d 71 6d 82 |Q%M..S......]qm.|
+Server Write key[32]:
+| 22 8e 83 c8 70 0f 43 e9 a2 85 08 25 82 52 93 72 |"...p.C....%.R.r|
+| 07 6b 3c 79 1a 9e 77 79 f0 c2 6b 62 5e 01 bf 94 |.k<y..wy..kb^...|
+Client Write IV[16]:
+| 8d c0 ba a0 95 35 3c 4f d6 96 33 87 ff 92 e0 78 |.....5<O..3....x|
+Server Write IV[16]:
+| 1e 6c 14 47 c9 cc 10 17 af a9 91 59 0f d2 30 6e |.l.G.......Y..0n|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #263 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67...
+looking for RSA pre-master0080a34aa68a1ab4c3cf96ca5afc9a068e82cadf846fb144...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..|
+| 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.|
+| 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*|
+| 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... |
+hash out[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+PRF out[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+key expansion[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+Client MAC key[20]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 |...! |
+Server MAC key[20]:
+| 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 75 22 5a 3b |.nm...3[....u"Z;|
+| 72 fc dd 11 |r... |
+Client Write key[32]:
+| d9 90 b0 18 52 4f 80 e0 f2 31 97 a7 cb ce 65 9f |....RO...1....e.|
+| e5 32 7c 31 b4 a5 0f fb eb b1 3f 58 98 20 86 72 |.2|1......?X. .r|
+Server Write key[32]:
+| 1f 9b ed ea 9e 28 4c 76 61 2c 96 75 57 c9 c8 3e |.....(Lva,.uW..>|
+| 01 10 2f d9 7b 52 48 f2 9c cf a2 75 eb c3 48 fe |../.{RH....u..H.|
+Client Write IV[16]:
+| df c2 e0 65 cc d5 1b 7d 41 90 f2 cc 91 c3 a2 19 |...e...}A.......|
+Server Write IV[16]:
+| ef cb eb c3 66 14 5f 48 27 84 d2 b3 94 79 87 ce |....f._H'....y..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f9 cd f8 0e 2a 35 1c 38 46 b8 97 ee d0 2d ad 13 |....*5.8F....-..|
+| 64 bf 9d db bc 38 b3 28 89 4d 91 61 37 9c 4d f1 |d....8.(.M.a7.M.|
+| 60 97 d3 e8 30 61 8d 4f 41 6e 25 ed 6f 7e 06 10 |`...0a.OAn%.o~..|
+| 82 25 58 bd 33 a9 83 0f ce ac 88 f7 fb d2 19 72 |.%X.3..........r|
+Plaintext[64]:
+| d8 db 31 5a 45 68 02 52 59 02 8d 8c 6b b4 e0 f5 |..1ZEh.RY...k...|
+| 14 00 00 0c d8 a7 bc e3 c6 f1 50 8b 6f 2c 9e f6 |..........P.o,..|
+| 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.|
+| 75 e6 8c 93 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |u...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.|
+| 75 e6 8c 93 |u... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #264 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1c e7 46 55 44 95 2c e0 54 e3 9a 5f 49 d7 29 28 |..FUD.,.T.._I.)(|
+| f4 a9 a5 cd ee a9 1d 6f 00 a3 9e c5 fa 99 8d 85 |.......o........|
+| 73 3b e9 84 48 a3 85 d7 d6 61 4c be fe 6f 6e 35 |s;..H....aL..on5|
+| 34 30 b3 c9 b2 0c 4e 96 ca 1d ad a3 dd a9 21 dd |40....N.......!.|
+Plaintext[64]:
+| c2 a4 95 cb 42 16 52 56 6b ab 48 02 63 36 6a d9 |....B.RVk.H.c6j.|
+| 14 00 00 0c 9b ca bc 2d 37 c6 5e f6 7a 33 71 e8 |.......-7.^.z3q.|
+| 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.|
+| af 01 59 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..Y?............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.|
+| af 01 59 3f |..Y? |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #265 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 1e ab cc b1 b6 4c d0 fb f9 84 f6 6d 1e 43 80 d7 |.....L.....m.C..|
+| c7 06 39 3e 38 de c6 38 9e 31 69 b6 1d e9 4e 2e |..9>8..8.1i...N.|
+| c1 7a 67 e1 19 7b 3f d8 92 21 f7 3c 30 85 c4 ff |.zg..{?..!.<0...|
+| 85 08 1a 5e 3d bf 8e 49 e3 b6 1f 6d f9 50 fe 99 |...^=..I...m.P..|
+| 9c b6 d4 c7 b6 81 2b 92 0f aa f6 b8 09 a8 03 0e |......+.........|
+| 7b 1a 02 9d 04 08 c0 10 2c 2a 0c 05 12 be 1c bb |{.......,*......|
+| c8 6c 83 7c 4a c6 7b ca 14 ee 7d 86 fe ea c0 f8 |.l.|J.{...}.....|
+Plaintext[112]:
+| a6 54 42 d0 c7 bf 33 a3 9c 3e dc 31 3d 40 bf ad |.TB...3..>.1=@..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 33 0d 0a 0d 0a 94 27 43 3c 34 7e 07 8b |4453.....'C<4~..|
+| a5 94 3d 0b ba f1 82 54 d5 0d 3a 21 03 03 03 03 |..=....T..:!....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 f9 9a f8 88 2f 31 15 24 07 80 a3 88 1b 23 b0 |%..../1.$.....#.|
+| 17 c4 76 f2 |..v. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52817 found (nil)
+association_find: TCP port 4453 found 0x3425530
+
+dissect_ssl enter frame #266 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| cb 1e 48 31 e7 63 1e 7f 99 78 23 80 2e 9a c3 3d |..H1.c...x#....=|
+| 9a 74 54 80 bc 1e 6d e5 8e ce 3a 2e 28 6b 3c 27 |.tT...m...:.(k<'|
+| 09 6c 99 07 c8 f9 63 84 53 b7 cb 7d 64 3f 04 dc |.l....c.S..}d?..|
+| ef 09 a3 9f 52 c8 dd a3 03 50 d9 d9 93 fa 19 0a |....R....P......|
+| a7 02 15 6c 44 43 62 c6 73 6b 5c 18 c0 3d 1c ce |...lDCb.sk\..=..|
+| db 41 fa 80 2f 78 f4 3f 16 74 e4 0f 05 12 4c d3 |.A../x.?.t....L.|
+| 4f 18 12 12 70 14 83 13 e2 4d 45 bd fe 7b 8b 03 |O...p....ME..{..|
+| 00 d6 8c 28 9a ec e8 9e 3f 76 0a df 98 0e 02 88 |...(....?v......|
+| fc 12 df 72 5f b3 85 5b 46 90 9d 84 72 58 cf 0e |...r_..[F...rX..|
+| 6f 25 ff 40 16 eb 8d 6b 44 e1 d3 0b 55 83 a5 0f |o%.@...kD...U...|
+| 14 d0 bd 0e b4 a2 45 a2 a9 31 58 05 76 c8 8e 47 |......E..1X.v..G|
+| 71 6c b0 e6 87 7f 11 77 c8 fd 19 f7 9a c1 ef b7 |ql.....w........|
+| 2c f1 05 83 f0 85 d0 a7 91 10 b5 1f 0c 54 4a 90 |,............TJ.|
+| 5c 6e bb c6 2e a7 d4 7a d6 a2 ce 23 5d 65 ab c5 |\n.....z...#]e..|
+| c2 fd 82 b0 2b de d6 86 22 c8 47 04 cf 23 8f e2 |....+...".G..#..|
+| de c2 5c 42 91 38 7b 4f 92 83 ef a6 b7 f7 62 22 |..\B.8{O......b"|
+| 6d 5a 0c bc 69 fa be 94 bf da 04 a8 7d e8 ea 37 |mZ..i.......}..7|
+| ef 91 d9 3f 50 e9 0c 15 d9 86 9b 1f ca 23 f1 5d |...?P........#.]|
+| e8 b2 31 64 11 00 db 65 7e 6b 03 6b 5d db 86 bc |..1d...e~k.k]...|
+| 43 62 cb af c2 7b e7 cb 09 1f 2e 76 e2 c3 7f 9a |Cb...{.....v....|
+| 0b 6a 81 99 83 c5 90 8d 8b 44 b7 87 4c 48 f5 ba |.j.......D..LH..|
+| 27 8d e1 ee 51 f8 28 50 36 05 02 99 26 cb 5a 26 |'...Q.(P6...&.Z&|
+| ac 21 a5 cb 75 11 d8 10 cf ee 12 31 b8 fe 1b 74 |.!..u......1...t|
+| 85 ae 19 32 9e 31 af a8 6f be 2d e9 6b 78 90 e5 |...2.1..o.-.kx..|
+| 51 b6 5b dd fa e8 7a dc 45 c8 29 75 f3 10 74 17 |Q.[...z.E.)u..t.|
+Plaintext[400]:
+| 78 b9 b9 b5 43 4a a2 10 2b 58 5d b4 0d 45 73 ab |x...CJ..+X]..Es.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R|
+| 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 84 88 3a 81 |nl'</script>..:.|
+| 34 a6 10 78 7a ae 78 fb 12 7e c3 79 18 c9 78 71 |4..xz.x..~.y..xq|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 61 90 93 11 23 77 13 ea a4 e9 b0 1f a3 bc 51 |.a...#w........Q|
+| 78 a2 17 80 |x... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4453 found 0x3425530
+
+dissect_ssl enter frame #267 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4e 95 cc 52 06 b4 4c 17 89 3a 8c 81 42 34 23 52 |N..R..L..:..B4#R|
+| 22 67 92 51 c5 fc be 40 0f a1 22 b0 d5 59 d2 c7 |"g.Q...@.."..Y..|
+| 4b 2b 16 d4 59 0a 38 9c 51 b8 6d 86 af a6 b9 22 |K+..Y.8.Q.m...."|
+Plaintext[48]:
+| 9e c3 0d 82 a9 67 6b 4d a5 4e 0c f5 40 9a 8f 12 |.....gkM.N..@...|
+| 01 00 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 |..7..d..Vc.p...I|
+| 99 87 66 a0 c6 d1 09 09 09 09 09 09 09 09 09 09 |..f.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 99 87 |7..d..Vc.p...I..|
+| 66 a0 c6 d1 |f... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #269 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2c a4 58 8b 8b 93 11 d3 3d 11 6b 35 42 be d7 52 |,.X.....=.k5B..R|
+| 33 27 b3 a3 3e de 83 f0 a8 e1 53 dc 9b c0 d4 71 |3'..>.....S....q|
+| 53 72 b8 fb 87 5d d1 7e 61 01 b3 41 c0 5d 56 3f |Sr...].~a..A.]V?|
+Plaintext[48]:
+| ff 5e e5 02 7a c0 2e 50 99 54 67 49 c2 35 6d 14 |.^..z..P.TgI.5m.|
+| 01 00 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b |..N..Q/#.R.."T.+|
+| 5b 9f 0b ac 53 8b 09 09 09 09 09 09 09 09 09 09 |[...S...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b 5b 9f |N..Q/#.R.."T.+[.|
+| 0b ac 53 8b |..S. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #274 (first time)
+ssl_session_init: initializing ptr 0x7facc3839530 size 688
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50333 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4457
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #276 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&|
+| a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.|
+| 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;|
+| 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. |
+hash out[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+PRF out[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+key expansion[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+Client MAC key[20]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 |..J8 |
+Server MAC key[20]:
+| b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f 89 44 4a 98 |..KU.X.:U-...DJ.|
+| db ad 27 69 |..'i |
+Client Write key[16]:
+| 62 d8 46 48 48 fa c3 98 43 81 83 58 fb df 64 e2 |b.FHH...C..X..d.|
+Server Write key[16]:
+| a2 26 cc 21 7e 20 1b 04 81 ad 69 c5 bf 1b 86 c5 |.&.!~ ....i.....|
+Client Write IV[16]:
+| 89 0b 05 b8 1b f3 f7 2f fa c6 98 1e 9c 4d 4c 68 |......./.....MLh|
+Server Write IV[16]:
+| 1c 61 a2 49 5a b2 90 2f fd 63 2a d8 4d 83 95 58 |.a.IZ../.c*.M..X|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #278 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6...
+looking for RSA pre-master49b0d526ec1cca1e189791ee6237d54b6d7a53ba163b9e3c...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&|
+| a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.|
+| 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;|
+| 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. |
+hash out[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+PRF out[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+key expansion[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+Client MAC key[20]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 |.|.Y |
+Server MAC key[20]:
+| 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 ba 32 ac 6d |5./....A.....2.m|
+| 01 8a 04 61 |...a |
+Client Write key[16]:
+| 4f 32 41 e7 55 47 90 32 66 e4 0b 57 ed d6 3d b0 |O2A.UG.2f..W..=.|
+Server Write key[16]:
+| e6 5e 04 6b c0 3f b5 c3 92 8e 62 c3 41 36 35 69 |.^.k.?....b.A65i|
+Client Write IV[16]:
+| 70 1b 35 77 16 97 09 d5 9b bb 8f 8a 97 4d ec 20 |p.5w.........M. |
+Server Write IV[16]:
+| 4e 96 94 6c 84 a7 85 7a bb d4 14 ff 4f c3 ad f2 |N..l...z....O...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b1 dc 9b 8b 30 62 dc 3c 73 65 7d 43 aa aa ed 69 |....0b.<se}C...i|
+| 7f 78 38 e3 b7 dc 7c b9 b1 c0 e2 8a 88 7b b9 d2 |.x8...|......{..|
+| bf 9a 79 78 27 45 55 16 ab 1c 90 0c 58 f9 6e a2 |..yx'EU.....X.n.|
+| e1 db c0 93 38 8e f0 84 dc 14 9a 74 2a ef 00 8d |....8......t*...|
+Plaintext[64]:
+| 9c 5e 9a a2 97 8a 97 b1 82 74 11 37 7c fc 4d cb |.^.......t.7|.M.|
+| 14 00 00 0c 5e bb 06 48 45 bf 04 0d bd 2e 9d 16 |....^..HE.......|
+| 3d f5 e0 35 e2 51 7a c5 67 6d ea 23 e1 29 5f 4c |=..5.Qz.gm.#.)_L|
+| a2 2c 58 df 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,X.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3d f5 e0 35 e2 51 7a c5 67 6d ea 23 e1 29 5f 4c |=..5.Qz.gm.#.)_L|
+| a2 2c 58 df |.,X. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #279 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 71 f8 9b 7a 5e 11 bb 24 38 93 87 db f1 2a dc 52 |q..z^..$8....*.R|
+| 5c 42 93 e9 1f 17 7d 49 8d ec a3 ad 98 25 40 01 |\B....}I.....%@.|
+| 59 a4 ed d0 10 3c f1 69 c8 78 a5 8d c4 ea e3 9b |Y....<.i.x......|
+| b6 88 46 90 cf 0e 6f 34 dc 6b ea df a9 53 70 3e |..F...o4.k...Sp>|
+Plaintext[64]:
+| 4c ca d8 e5 92 a5 96 fb 1d 54 52 e6 fd c1 06 64 |L........TR....d|
+| 14 00 00 0c 61 42 f8 38 c7 91 5d 72 b6 74 92 dc |....aB.8..]r.t..|
+| 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.|
+| a1 15 70 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..p.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.|
+| a1 15 70 9d |..p. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #280 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 73 db 77 89 e3 a7 c9 fb 53 48 d3 2a 85 71 79 da |s.w.....SH.*.qy.|
+| f3 5b e0 ab d0 f7 a0 5d d2 43 06 6f 3c 01 9a c1 |.[.....].C.o<...|
+| 79 ba 05 f1 a0 67 3d 23 69 18 9c 2b 70 94 71 1c |y....g=#i..+p.q.|
+| 8d f4 25 e2 03 13 f4 91 e2 8c c1 46 43 1b ad a6 |..%........FC...|
+| 25 88 44 89 05 55 11 e8 be 9a b7 5b 72 48 2e a7 |%.D..U.....[rH..|
+| b9 a5 a6 6d dc 81 0f 09 45 ca 2c c2 c3 f0 b2 b8 |...m....E.,.....|
+| 87 8c 4c c6 a7 fe 6d 03 a0 fe 5e 6d 0b 80 08 14 |..L...m...^m....|
+Plaintext[112]:
+| 59 db 8a 5f e8 a2 a8 e7 ad 17 00 35 cd ef 3a 69 |Y.._.......5..:i|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12|
+| 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445|
+| 37 0d 0a 0d 0a 22 2d a5 65 9f 4f 66 55 39 1a 50 |7...."-.e.OfU9.P|
+| e1 09 71 ac 14 55 3d 43 4b 06 06 06 06 06 06 06 |..q..U=CK.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 10 58 a5 55 ab da cd ab 83 64 d5 c0 12 d4 df 14 |.X.U.....d......|
+| 01 a0 fa 18 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50333 found (nil)
+association_find: TCP port 4457 found 0x3425860
+
+dissect_ssl enter frame #281 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 45 ec 2f af ab d8 64 59 62 19 e5 db 53 fd ab 59 |E./...dYb...S..Y|
+| c7 41 de 02 e9 9f 13 49 f3 7b 96 54 89 84 04 57 |.A.....I.{.T...W|
+| 0b b3 b4 99 7e 7e 8b 85 47 41 e7 0f 82 a9 d9 81 |....~~..GA......|
+| a1 10 f0 12 66 13 07 5f 17 64 12 80 b2 d1 aa 64 |....f.._.d.....d|
+| 87 9f 8c 63 f0 c3 d9 67 b0 e7 a2 3d 7d f7 86 4c |...c...g...=}..L|
+| a4 62 10 f4 46 67 53 19 14 ea 31 14 1a cd be a5 |.b..FgS...1.....|
+| fd 30 ec 60 31 4e 95 a6 1e 5c 4d c7 5a 5f 7c de |.0.`1N...\M.Z_|.|
+| 80 de b2 9a 93 c9 96 e8 76 95 1b 18 cb 95 e9 80 |........v.......|
+| 3b c7 78 11 14 45 90 42 42 44 19 bc 9f 5e 17 6b |;.x..E.BBD...^.k|
+| 56 06 de d4 52 c4 50 4e 2f 4b 8a 0e 24 b9 72 c0 |V...R.PN/K..$.r.|
+| 9b 03 d2 4f a8 3e 15 4c b4 58 8f 74 58 bb 2f 16 |...O.>.L.X.tX./.|
+| a0 6f 68 7d dd 15 89 37 9e 67 3a e0 84 a8 92 cd |.oh}...7.g:.....|
+| b8 1f 8c 7b d8 ec 8a ff 88 83 a6 bc 64 2a aa 08 |...{........d*..|
+| e5 54 1b 03 d9 2e 20 3e ca 17 03 51 0d ae 2e 7f |.T.... >...Q....|
+| d3 d1 df 7d 9e 98 1f 3d 14 51 ba c2 67 69 c6 8e |...}...=.Q..gi..|
+| 71 3e f6 01 06 4e 3a 16 47 27 f7 52 07 fb 01 ae |q>...N:.G'.R....|
+| eb 09 64 33 49 05 0e f3 33 1f 07 5b aa 2b 14 de |..d3I...3..[.+..|
+| f7 95 a2 c6 f1 8a a3 41 5e 25 3b be 59 b8 6d 4d |.......A^%;.Y.mM|
+| 88 91 77 e9 44 ab 6a 60 14 09 c9 0b 7f 60 9d 8c |..w.D.j`.....`..|
+| 1e c5 07 c6 9d 29 60 1f 6a 0a 93 dc 2e 14 f9 c3 |.....)`.j.......|
+| 5b 9f bf 36 59 44 25 09 e6 12 89 74 93 44 51 1a |[..6YD%....t.DQ.|
+| 00 34 af 2c 79 36 a5 08 6b 55 de 83 a0 ca cf 62 |.4.,y6..kU.....b|
+| f2 a2 9a 76 94 4b ed 96 34 5d 54 51 82 d9 9b 2b |...v.K..4]TQ...+|
+| 3a 1a 2e 2a 06 ec 48 50 ea 5f a4 2a 5f fd e1 f3 |:..*..HP._.*_...|
+| 1a ad f2 dc 1c ff 33 8c 68 f2 3d 95 ba e6 bc ac |......3.h.=.....|
+Plaintext[400]:
+| 9a c6 14 70 ac 6f a4 c0 1f c0 e8 49 a0 b9 99 b5 |...p.o.....I....|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL|
+| 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 7f 41 57 03 d3 08 fd 78 86 2b aa 3a b5 57 5e 78 |.AW....x.+.:.W^x|
+| 7d 5a 42 00 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |}ZB.............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 21 c6 d6 7a 18 f5 c7 4e cf 09 55 6b e0 e1 f1 a4 |!..z...N..Uk....|
+| 8b be e0 c5 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4457 found 0x3425860
+
+dissect_ssl enter frame #282 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 96 2c ce 53 2f df 3a cf 80 7e f0 f3 0e c5 48 eb |.,.S/.:..~....H.|
+| 58 26 21 2e b2 a2 78 e8 9a d4 be da fe d5 e1 9b |X&!...x.........|
+| 1c cb 21 4d 24 8f fc b5 1d dd 8f 6a 54 ba cd 98 |..!M$......jT...|
+Plaintext[48]:
+| 7b 05 0a ea 9a e5 6e e4 4d 05 35 38 59 b9 57 b7 |{.....n.M.58Y.W.|
+| 01 00 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b |......e....qq.0.|
+| f8 d5 21 8a 4b 7b 09 09 09 09 09 09 09 09 09 09 |..!.K{..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b f8 d5 |....e....qq.0...|
+| 21 8a 4b 7b |!.K{ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #284 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c3 77 31 8c 96 9d 3b 7c bf d8 24 fb a1 70 d4 a5 |.w1...;|..$..p..|
+| a0 b9 a5 5f 1e f9 1c a6 14 f1 f0 6f 05 dc eb ff |..._.......o....|
+| aa f3 aa da 25 41 1c 89 7f 9c 91 f3 cd cd aa 55 |....%A.........U|
+Plaintext[48]:
+| 64 cc 71 81 da 80 c2 c1 4b 7c e6 d9 f9 26 09 3e |d.q.....K|...&.>|
+| 01 00 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f |...pn_TF.1/....?|
+| 7c 4a 10 ee 54 13 09 09 09 09 09 09 09 09 09 09 ||J..T...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f 7c 4a |.pn_TF.1/....?|J|
+| 10 ee 54 13 |..T. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #289 (first time)
+ssl_session_init: initializing ptr 0x7facc383baf0 size 688
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44746 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4458
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #291 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..|
+| 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.|
+| 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..|
+| ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. |
+hash out[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+PRF out[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+key expansion[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+Client MAC key[20]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 |..M. |
+Server MAC key[20]:
+| ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da 5a eb 1b 81 |.V.).z...5..Z...|
+| e3 58 ec 44 |.X.D |
+Client Write key[16]:
+| 29 3e 75 11 5e e1 37 30 9b 49 ac ea 01 8f 95 b6 |)>u.^.70.I......|
+Server Write key[16]:
+| 6a 87 90 52 1a c5 73 95 2e 6d 7b e5 8b 02 ed 89 |j..R..s..m{.....|
+Client Write IV[16]:
+| 18 be a5 f3 a0 6c 5d cc ee 0b 94 bf ee d4 18 97 |.....l].........|
+Server Write IV[16]:
+| 62 5b 3f ab 84 2d b7 3d ea 1a ec 7e f5 de ea 12 |b[?..-.=...~....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #293 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f...
+looking for RSA pre-master008032041c81e691596ba5ab0fbf45b29c5f64c0e2d8dcd8...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..|
+| 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.|
+| 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..|
+| ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. |
+hash out[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+PRF out[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+key expansion[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+Client MAC key[20]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 |fn. |
+Server MAC key[20]:
+| 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 52 93 70 4a |..#...~:6..$R.pJ|
+| 12 e4 9c 7f |.... |
+Client Write key[16]:
+| 08 1c d3 36 74 e5 12 9c d8 83 fb c2 0d 56 25 d3 |...6t........V%.|
+Server Write key[16]:
+| 58 ac 0e e3 57 2d fa 10 b7 fb 9b 3e 5d d1 c8 1d |X...W-.....>]...|
+Client Write IV[16]:
+| b3 67 57 e3 04 c7 25 ed 97 21 bd 41 7a 2e 87 6e |.gW...%..!.Az..n|
+Server Write IV[16]:
+| 4b c9 01 2e 82 70 53 01 71 41 ef 52 83 75 18 62 |K....pS.qA.R.u.b|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 76 ee 05 b3 ce 43 54 ae b7 42 80 62 99 39 5e 96 |v....CT..B.b.9^.|
+| fe d1 a1 fe 08 a5 93 da a2 46 2b 02 e6 7a f3 d0 |.........F+..z..|
+| 20 af 2c 26 3b 07 89 48 c0 6a 0e a2 16 ec b9 c6 | .,&;..H.j......|
+| 90 d0 c7 7a aa ca d2 f0 02 23 2d b9 e5 48 4f 0f |...z.....#-..HO.|
+Plaintext[64]:
+| d4 53 7a 8c d2 0b 73 47 f2 f9 27 88 99 10 ee 46 |.Sz...sG..'....F|
+| 14 00 00 0c b0 2d f1 76 d2 be 56 e4 9d e9 0a 53 |.....-.v..V....S|
+| b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....|
+| 60 79 d0 59 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |`y.Y............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....|
+| 60 79 d0 59 |`y.Y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #294 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 28 a6 e6 11 e9 7a 6a 68 9c 1b 91 91 4b d9 f7 b4 |(....zjh....K...|
+| 74 cb a2 a1 67 0c 63 a5 ac 46 e4 db 84 fd 8e 66 |t...g.c..F.....f|
+| 27 15 b4 2f 3c 19 3e d0 1a 3d a7 47 6a 4c eb e0 |'../<.>..=.GjL..|
+| 67 77 56 3d df 69 e7 b4 c5 87 83 34 30 fc 91 38 |gwV=.i.....40..8|
+Plaintext[64]:
+| 52 04 27 46 3c 6c 26 04 af eb 2d 3f ff 19 31 c3 |R.'F<l&...-?..1.|
+| 14 00 00 0c 26 5c cb b9 4b a0 62 cb 2e b0 f2 18 |....&\..K.b.....|
+| e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61|
+| b9 71 27 60 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.q'`............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61|
+| b9 71 27 60 |.q'` |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #295 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 12 20 e2 74 2a 11 c4 10 ed a0 aa a7 23 ca 38 c3 |. .t*.......#.8.|
+| f4 3d 4b 06 32 ed ff 62 b8 42 e4 ed c8 86 39 74 |.=K.2..b.B....9t|
+| 3b 71 af c4 0e 97 b6 7c 2a ef ef 92 d0 01 fc bd |;q.....|*.......|
+| 78 65 81 6e e2 cb 1b 6d 28 a4 60 2a 75 ba 35 e6 |xe.n...m(.`*u.5.|
+| 97 f8 04 9c fa d3 3c 07 30 7e 27 66 4f 19 33 3b |......<.0~'fO.3;|
+| 7a c1 33 d7 ef 7a a5 59 53 15 05 7c bf dc d7 08 |z.3..z.YS..|....|
+| e4 17 a2 d5 08 2c 89 eb 40 8a 07 19 90 28 52 29 |.....,..@....(R)|
+| 69 af 4f 26 e7 99 f5 2f 54 59 ca 03 f6 a7 c1 a6 |i.O&.../TY......|
+Plaintext[128]:
+| a7 c0 77 b3 8c 76 cc 8c 41 50 49 ef 86 d3 0c 3f |..w..v..API....?|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a c6 c4 f2 |n.nl:4458.......|
+| 60 32 67 48 e0 11 bc 98 89 66 b5 48 48 38 2d ae |`2gH.....f.HH8-.|
+| a8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 15 32 91 17 d5 ed 1a c3 1c ab 40 d5 3e c9 2b 25 |.2........@.>.+%|
+| bb 4b 6f be |.Ko. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44746 found (nil)
+association_find: TCP port 4458 found 0x34258f0
+
+dissect_ssl enter frame #296 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fd a4 cd 1c ed 1b 11 1a d1 45 ee 85 7a 0f 23 3b |.........E..z.#;|
+| 3e 3f 2a 0e 17 28 88 92 f2 19 9b f9 e8 f7 ff 34 |>?*..(.........4|
+| 8b 11 11 9f 63 f7 ff 22 5d a0 3f b1 9a 94 c0 d4 |....c.."].?.....|
+| 21 17 f6 ff d8 a0 1c cf 03 b0 27 35 51 34 25 0e |!.........'5Q4%.|
+| 6e cb fa 41 3e 34 c5 f4 27 b6 59 bc 5d ae 8e c1 |n..A>4..'.Y.]...|
+| 12 48 ef 40 91 5a f1 42 e3 02 6a 54 29 f9 05 19 |.H.@.Z.B..jT)...|
+| e0 21 01 17 69 a8 84 35 08 ea 09 e2 dd 1c 54 00 |.!..i..5......T.|
+| 3c 2d 7d 9a f0 10 4d c3 c6 cf 5e 09 ff d0 01 51 |<-}...M...^....Q|
+| 78 f0 63 42 9a 58 1d b4 30 4a 40 50 df 39 06 56 |x.cB.X..0J@P.9.V|
+| 3e b4 ec 9d 64 09 f0 8e d6 be 4f e3 48 33 68 b5 |>...d.....O.H3h.|
+| 94 d5 f6 db 96 e7 8e 18 2b fc 5d 5f c6 2e d7 2d |........+.]_...-|
+| 99 73 c3 f4 dd 37 54 b1 f2 5f d8 c9 de 5f bb 69 |.s...7T.._..._.i|
+| 39 68 34 8f 49 24 ca 77 e0 f0 13 20 eb c7 01 92 |9h4.I$.w... ....|
+| b6 b8 6f de 78 28 37 5a 09 69 41 2a db 3d 62 a4 |..o.x(7Z.iA*.=b.|
+| 23 1f af 54 b3 ce 6e 4e 71 35 d2 e0 db 1d 02 1f |#..T..nNq5......|
+| f8 33 d1 97 cb d7 a5 c6 f9 46 b6 98 ff 9b 26 15 |.3.......F....&.|
+| de 38 ea 5d c1 1c e2 8e 62 7d 16 c1 51 c9 ba 53 |.8.]....b}..Q..S|
+| fe 48 8e df b0 90 c5 f5 57 cd 82 31 60 3f d9 c8 |.H......W..1`?..|
+| 22 a7 34 fd 28 2c c6 59 81 df bd 53 a8 85 54 6c |".4.(,.Y...S..Tl|
+| 57 b4 6d ea d8 16 fa 9b 1b 6e 46 8d 66 6c c7 bd |W.m......nF.fl..|
+| 95 d7 0e 3c 44 84 d4 d9 cd f4 93 01 04 54 9a d8 |...<D........T..|
+| be b7 b1 d2 c3 3d 58 44 6d aa 8f 02 32 27 e7 6c |.....=XDm...2'.l|
+| 1b e3 04 0a 99 dd 11 82 03 d7 df 8f 70 f1 b7 a3 |............p...|
+| ae 81 ce de f5 4f 5a f9 fa 7f 51 cc 92 69 5d cc |.....OZ...Q..i].|
+| 2f 97 5e 55 b2 cf 22 0f 1b f3 70 92 82 d6 5d 3b |/.^U.."...p...];|
+Plaintext[400]:
+| 16 66 ed 93 a4 97 21 1f 54 59 42 ce 75 fd ce 8e |.f....!.TYB.u...|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 58 05 86 66 e9 10 03 7d 14 04 31 53 69 a1 b6 13 |X..f...}..1Si...|
+| 82 52 ac c3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 8e f2 0c 2c 53 73 b8 87 7c 12 33 34 a4 d9 fe |....,Ss..|.34...|
+| be 8b 6d f5 |..m. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4458 found 0x34258f0
+
+dissect_ssl enter frame #297 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 7d e0 a4 b5 95 8c d7 b4 f5 da c6 ce fa 28 84 19 |}............(..|
+| db 25 fa 66 97 d7 3e fa 01 9f 25 8c cd ac 46 d2 |.%.f..>...%...F.|
+| b4 8a 04 b8 4b 0a 1d 9c 47 56 42 1f 6e 4b 03 5a |....K...GVB.nK.Z|
+Plaintext[48]:
+| e2 80 85 77 af ee bc a5 4c 1a 9d 71 01 fe c3 58 |...w....L..q...X|
+| 01 00 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 |...V......X3).!0|
+| 49 74 f0 be 0c ce 09 09 09 09 09 09 09 09 09 09 |It..............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 49 74 |.V......X3).!0It|
+| f0 be 0c ce |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #299 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9d 88 b2 b6 f1 fc 08 ad 12 97 a1 40 80 72 24 7a |...........@.r$z|
+| a4 a8 28 0f c5 e2 ea ae ba 03 5f 95 27 76 48 e1 |..(......._.'vH.|
+| ed 5d 38 23 df a1 83 bb da 3d 2a 07 21 0e 36 18 |.]8#.....=*.!.6.|
+Plaintext[48]:
+| 7a 2c 25 f8 59 43 18 2f ea e6 a5 68 1a 1d 12 cc |z,%.YC./...h....|
+| 01 00 ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 |...i..../}$.}...|
+| a1 84 50 3f a2 ed 09 09 09 09 09 09 09 09 09 09 |..P?............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 a1 84 |.i..../}$.}.....|
+| 50 3f a2 ed |P?.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #304 (first time)
+ssl_session_init: initializing ptr 0x7facc383dff0 size 688
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45627 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4459
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #306 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X|
+| 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.|
+| 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..|
+| 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. |
+hash out[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+PRF out[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+key expansion[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+Client MAC key[20]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f |.J|. |
+Server MAC key[20]:
+| 93 9b ba 45 ab 1e a7 34 64 aa 88 3e 3b c5 33 e5 |...E...4d..>;.3.|
+| da 1e 6d da |..m. |
+Client Write key[16]:
+| 58 a3 23 dc 5e ce be 49 78 ff 86 f6 40 24 f8 6b |X.#.^..Ix...@$.k|
+Server Write key[16]:
+| 2b c9 6b a8 3f b3 63 ae 7f a9 61 33 d5 2a 35 5a |+.k.?.c...a3.*5Z|
+Client Write IV[16]:
+| 59 eb 97 39 0a 95 4d 35 52 6a e2 b7 e4 43 11 97 |Y..9..M5Rj...C..|
+Server Write IV[16]:
+| b3 3f 16 f1 cf 48 de cb 3d 96 4c 6b 90 e7 14 ed |.?...H..=.Lk....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #308 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cf...
+looking for RSA pre-master00804d7ad45959353a60dbb7bc3b8677ddfe7950df38c6cb...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X|
+| 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.|
+| 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..|
+| 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. |
+hash out[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+PRF out[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+key expansion[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+Client MAC key[20]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 |..$Q |
+Server MAC key[20]:
+| 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 54 df 97 7c |...Il....%o.T..||
+| 72 3c e3 dd |r<.. |
+Client Write key[16]:
+| 47 95 1d cb 70 fd a0 9d 2f a5 29 f8 a9 cb 2f 13 |G...p.../.).../.|
+Server Write key[16]:
+| 35 4d 4c a5 32 67 92 76 1b fc dd 73 b1 cc ad d6 |5ML.2g.v...s....|
+Client Write IV[16]:
+| ac b6 89 a7 36 1a 35 fb 76 13 5c 55 8e 01 a8 93 |....6.5.v.\U....|
+Server Write IV[16]:
+| 23 dd 9c 11 49 ad 1d 14 19 7b 40 5a 67 ae 1d 43 |#...I....{@Zg..C|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 89 31 47 3e d2 51 cd 32 0e c5 14 19 f7 3d 2d 99 |.1G>.Q.2.....=-.|
+| 8c 35 a5 3d df eb 96 83 17 2c d2 22 7a b0 ab 8d |.5.=.....,."z...|
+| dc 7c 40 af c7 93 e7 e8 32 94 8f 81 86 41 6a d4 |.|@.....2....Aj.|
+| 4e 77 72 44 28 3a d7 73 1c e3 2d 96 49 e4 4b 67 |NwrD(:.s..-.I.Kg|
+Plaintext[64]:
+| cc 32 e8 ed f2 bd aa a3 1c e7 4e 18 12 54 3b cb |.2........N..T;.|
+| 14 00 00 0c 56 fa fb b6 f1 01 61 53 6b e7 f2 16 |....V.....aSk...|
+| 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.|
+| 61 21 f0 d5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |a!..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.|
+| 61 21 f0 d5 |a!.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #309 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 6f 7d 75 d5 68 e8 50 bf 56 74 e2 31 32 50 be cd |o}u.h.P.Vt.12P..|
+| 7e 76 21 ef f4 4a f9 5e f1 4b 32 fe 4d 66 8b a7 |~v!..J.^.K2.Mf..|
+| 26 d4 1b 36 26 ab 52 90 0f d0 b3 62 1f e0 65 1b |&..6&.R....b..e.|
+| f8 4f 61 3b 8d 91 3f 2d 02 03 ba 60 a5 f4 8c ee |.Oa;..?-...`....|
+Plaintext[64]:
+| 31 53 dd d4 5b 02 e9 48 30 8d f1 3d 8b f1 04 25 |1S..[..H0..=...%|
+| 14 00 00 0c 7a 76 e1 e0 89 d8 c7 5b 54 3c c2 99 |....zv.....[T<..|
+| ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(|
+| 27 9e 48 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |'.H.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(|
+| 27 9e 48 0b |'.H. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #310 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| d2 7a a9 6b d2 35 c6 d3 63 d3 68 6b 62 1c c1 96 |.z.k.5..c.hkb...|
+| bb 3d 71 8c dd 9f d6 05 e4 7d ad 8a 7d be de 5b |.=q......}..}..[|
+| 8f 8c 2f 09 a5 03 c1 01 9a d5 f1 41 93 71 1a 1c |../........A.q..|
+| 1d 67 7e c4 01 1b 6b 0d 77 d8 c3 66 85 b4 3c 42 |.g~...k.w..f..<B|
+| d9 e4 d0 f9 a2 3e 16 35 26 bd 7b 0d ee 30 25 eb |.....>.5&.{..0%.|
+| be 0f 33 92 01 16 47 88 af be 92 f4 ee 66 8c 37 |..3...G......f.7|
+| 1a a4 2e 6f 6d 01 a6 ad 7c 55 a7 d0 47 a8 fe f6 |...om...|U..G...|
+| 05 9e 7c ed a1 ea 1e a3 ee 6e 46 92 26 b0 02 8a |..|......nF.&...|
+Plaintext[128]:
+| a0 ef 57 7a 37 3a 92 ca 76 dd d5 36 59 33 69 6e |..Wz7:..v..6Y3in|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a 3d 98 be |n.nl:4459....=..|
+| ad c3 82 26 b5 c4 04 26 ab 26 e3 c4 0b 51 75 e6 |...&...&.&...Qu.|
+| 2d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |-...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 03 48 86 ee fb d5 a2 b3 65 e6 04 af 0b 04 61 72 |.H......e.....ar|
+| b0 ed 40 70 |..@p |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45627 found (nil)
+association_find: TCP port 4459 found 0x3328090
+
+dissect_ssl enter frame #311 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d3 f6 28 f3 d3 92 1b 76 e1 8d 33 fa 6a f0 5f 26 |..(....v..3.j._&|
+| 15 48 68 96 f8 26 f3 50 ed 3a be 5d ee c4 72 d2 |.Hh..&.P.:.]..r.|
+| 22 46 c9 20 d4 ea 27 8e a2 be 42 98 92 a7 ab db |"F. ..'...B.....|
+| 25 cb 67 3c b9 5e 10 f5 1b 99 7b 2c 62 d1 ff d6 |%.g<.^....{,b...|
+| 15 d2 35 37 7f 6c 38 a9 15 a2 e8 9f 43 53 dd 85 |..57.l8.....CS..|
+| 1e a8 11 03 4a 4d da 0a cc 4c 39 f6 e2 dd b7 27 |....JM...L9....'|
+| 71 7d 52 18 d5 5e 11 c0 81 be 94 53 38 59 a4 12 |q}R..^.....S8Y..|
+| f2 0a f6 60 19 db 0c dd fa 81 ba f9 3f c0 53 ee |...`........?.S.|
+| 67 f3 04 88 04 47 6e 60 98 cb f2 85 a7 1e f4 ef |g....Gn`........|
+| a7 af bb a1 a6 6e 77 d9 ff e7 16 ce 12 99 77 eb |.....nw.......w.|
+| 3c ff 72 63 95 51 49 51 27 74 58 78 11 59 c8 8a |<.rc.QIQ'tXx.Y..|
+| cf f7 c9 dc 54 24 43 0e 67 a4 cd bf 04 65 f2 5a |....T$C.g....e.Z|
+| e0 58 29 27 c9 f2 51 51 b6 0e e7 b2 20 ad 31 f7 |.X)'..QQ.... .1.|
+| d6 7f 1d 01 02 f0 6c 28 e1 0a 4c 06 75 96 13 68 |......l(..L.u..h|
+| e2 36 33 79 8f c8 9b 9d 69 ba 41 a6 70 44 2c 1b |.63y....i.A.pD,.|
+| 90 e5 ea 22 ee 70 96 cf e2 50 b6 b1 f7 56 66 8b |...".p...P...Vf.|
+| 06 ba fc 8c e3 68 d0 29 6c 50 3c 74 da 97 26 f1 |.....h.)lP<t..&.|
+| b7 da e8 79 80 52 45 1e 2a 5d 11 79 c1 6b 0e 65 |...y.RE.*].y.k.e|
+| 62 a8 eb 00 39 c7 b2 6e 6f f8 ab 9e a7 fe 15 53 |b...9..no......S|
+| 6a bf 96 0a 9a cf 20 13 60 9e a5 88 d1 5c c1 2e |j..... .`....\..|
+| 7e 7f 6c d1 cf e7 a4 f7 7b 0f 07 87 db 64 77 83 |~.l.....{....dw.|
+| 34 09 99 14 a7 0e a2 ab 08 e3 87 ee 12 7b 70 a5 |4............{p.|
+| 2d bd 55 3f d6 91 66 fa 7d 76 c9 62 b1 b1 b8 94 |-.U?..f.}v.b....|
+| ac 09 51 4e 28 fb e2 dc af 18 c1 30 ce bf 99 21 |..QN(......0...!|
+| 44 9a 9f 41 4a 4e da dd b8 1e 3c 55 b0 e3 8f e9 |D..AJN....<U....|
+Plaintext[400]:
+| d6 64 5d 94 4d 17 cc d5 18 1f 6c 6a 59 ff 69 e4 |.d].M.....ljY.i.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| e7 07 5d 56 06 9f 5f 9e 62 c4 ac 44 5a 46 88 08 |..]V.._.b..DZF..|
+| c0 5d a9 25 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.].%............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9a 34 f7 7e ac a3 fa 2d d9 6e 32 9d d8 53 af f5 |.4.~...-.n2..S..|
+| 41 dc e8 24 |A..$ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4459 found 0x3328090
+
+dissect_ssl enter frame #312 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3e 26 3f 1a 0f b8 ba 30 38 51 ba 0e 2b d6 7e f9 |>&?....08Q..+.~.|
+| 17 63 34 f2 5f 32 d7 d5 15 42 95 9a b6 2f 32 93 |.c4._2...B.../2.|
+| d3 b8 c2 8b ff fd 10 c6 81 d3 72 db d6 d6 ad 44 |..........r....D|
+Plaintext[48]:
+| 56 2c b3 ff 6c 96 0e c4 f5 ad a3 87 c5 99 04 71 |V,..l..........q|
+| 01 00 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 |..J;...f.?(.,...|
+| ca a8 13 ec 1f 4a 09 09 09 09 09 09 09 09 09 09 |.....J..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 ca a8 |J;...f.?(.,.....|
+| 13 ec 1f 4a |...J |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #314 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| fb 15 dc 4b ab c1 4d f4 ce 06 a6 27 76 3f 01 4a |...K..M....'v?.J|
+| 2e 5e 4e 52 c0 9e a8 56 e2 9c 03 e8 54 2c 65 34 |.^NR...V....T,e4|
+| 30 92 c7 5d 78 d8 50 ab ab 09 47 fa 22 51 55 b9 |0..]x.P...G."QU.|
+Plaintext[48]:
+| 7d 23 d5 16 80 35 92 c6 14 53 8c 1c bb c3 7a 2f |}#...5...S....z/|
+| 01 00 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 |...:.6..FN..,...|
+| 6d 6b 10 bb 5d 2a 09 09 09 09 09 09 09 09 09 09 |mk..]*..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 6d 6b |.:.6..FN..,...mk|
+| 10 bb 5d 2a |..]* |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #319 (first time)
+ssl_session_init: initializing ptr 0x7facc3840530 size 688
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45960 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4463
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #321 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G|
+| 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.|
+| 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....|
+| 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= |
+hash out[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+PRF out[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+key expansion[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+Client MAC key[20]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 |.... |
+Server MAC key[20]:
+| 76 10 cc d5 50 2a 86 bd 16 07 49 53 f7 d3 3e 3c |v...P*....IS..><|
+| 17 28 b4 b8 |.(.. |
+Client Write key[32]:
+| a2 ab 9c b8 88 7c b6 2e 70 e2 d1 ca c8 11 9b e0 |.....|..p.......|
+| 4a 52 46 48 3b e9 8d f6 11 09 8d 54 62 29 25 48 |JRFH;......Tb)%H|
+Server Write key[32]:
+| bd 6c 26 ac 29 7e d2 e5 0a e0 d9 a1 75 fd cd 1a |.l&.)~......u...|
+| 6a f1 6d d3 f8 83 be 47 d0 99 fe 8b 13 46 0a e6 |j.m....G.....F..|
+Client Write IV[16]:
+| b6 15 ee a8 55 22 16 51 cb cc f2 cc 09 cf 21 3c |....U".Q......!<|
+Server Write IV[16]:
+| c3 b5 2e 5b e3 bb a8 86 70 55 ea f6 83 1f f8 6f |...[....pU.....o|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #323 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6...
+looking for RSA pre-master28a5e5ae37eb7d5c1b3740154edc21c244ade2aa80b2c5a9...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G|
+| 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.|
+| 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....|
+| 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= |
+hash out[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+PRF out[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+key expansion[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+Client MAC key[20]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 |..|. |
+Server MAC key[20]:
+| 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 9d a1 9f 69 |.,i............i|
+| e6 49 d6 dd |.I.. |
+Client Write key[32]:
+| ef fc d6 9e 44 fc 5f 81 35 02 8b 36 64 82 23 43 |....D._.5..6d.#C|
+| 30 74 6a cd 9f ea 1e 8a 49 74 50 3d 3b 5c f2 4b |0tj.....ItP=;\.K|
+Server Write key[32]:
+| 73 02 65 23 da 1f 5a d8 ed 23 88 ca f4 e1 83 d7 |s.e#..Z..#......|
+| e4 07 4c ba cf 48 9b ef cd b1 86 a0 57 8a 98 41 |..L..H......W..A|
+Client Write IV[16]:
+| 9f ed 72 49 5d 55 79 e5 50 72 78 77 39 7c be cf |..rI]Uy.Prxw9|..|
+Server Write IV[16]:
+| 01 f6 41 cf 24 03 3d 64 be 57 98 9c ce ad e6 5a |..A.$.=d.W.....Z|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 47 fb 9b b3 2e b2 65 44 ee 57 a7 f1 85 8e 12 a1 |G.....eD.W......|
+| 43 56 d0 2e c9 23 46 5d a9 c9 7f 35 75 35 a4 fa |CV...#F]...5u5..|
+| 1d 43 9f b0 05 db f4 90 e4 df 2f 14 44 90 35 18 |.C......../.D.5.|
+| 4d 12 bb 03 57 22 96 b0 08 46 02 de df 62 98 d7 |M...W"...F...b..|
+Plaintext[64]:
+| 24 b4 d0 d7 36 77 13 dc 8e d1 bc 52 c6 d7 7f f8 |$...6w.....R....|
+| 14 00 00 0c a4 a1 8e 8a a4 ee 69 b8 73 ed e5 91 |..........i.s...|
+| fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......|
+| 88 11 12 6c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...l............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......|
+| 88 11 12 6c |...l |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #324 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 02 72 8d d9 a7 0e 3f 32 a1 e9 0b 9f 93 f6 7e 34 |.r....?2......~4|
+| 39 23 ae 0d eb d7 b8 44 bb 2f 93 f1 83 35 24 22 |9#.....D./...5$"|
+| 78 28 7f 03 8a 3c 74 83 27 0d b0 fb 46 56 6d 91 |x(...<t.'...FVm.|
+| ae 8e 54 fd 98 a1 74 ee 33 9d 2d aa 65 29 5c 4c |..T...t.3.-.e)\L|
+Plaintext[64]:
+| f6 d4 9b d1 5c 7b 6d c4 f5 f2 79 77 23 cf 7f cb |....\{m...yw#...|
+| 14 00 00 0c 60 5d 71 3c 03 df f1 a7 bc 91 99 b7 |....`]q<........|
+| 7a 79 41 a0 dd dd af 7e 3b 97 5f 72 73 91 8d a7 |zyA....~;._rs...|
+| 5b 20 05 39 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |[ .9............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7a 79 41 a0 dd dd af 7e 3b 97 5f 72 73 91 8d a7 |zyA....~;._rs...|
+| 5b 20 05 39 |[ .9 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #325 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 85 78 9f 2c 72 2b 33 2b 32 cd 87 d8 24 ea 0c 37 |.x.,r+3+2...$..7|
+| 33 4e 2b 57 19 b4 54 55 6e b2 98 88 c0 d7 58 9a |3N+W..TUn.....X.|
+| 89 25 44 55 9c 04 71 00 9a 0b 52 d9 6d 3e 77 e8 |.%DU..q...R.m>w.|
+| a5 91 88 b0 1e 61 8e 98 3f 31 23 63 47 91 59 31 |.....a..?1#cG.Y1|
+| d1 d1 bb ab f8 d5 d5 a2 5f 1c 96 79 20 6c e3 65 |........_..y l.e|
+| db 3d 7f b2 be d9 e5 31 86 23 02 f6 01 a8 c6 92 |.=.....1.#......|
+| 20 5a 32 85 59 28 18 ea f7 d6 aa 87 1b c8 1c 5a | Z2.Y(.........Z|
+Plaintext[112]:
+| 85 d9 c4 10 d3 53 d3 34 da 45 35 ae 4d 4a 96 13 |.....S.4.E5.MJ..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25|
+| 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446|
+| 33 0d 0a 0d 0a 9b ae 04 4b b5 f7 b2 5c 7b 34 a9 |3.......K...\{4.|
+| cc 22 b4 7d b9 ed 9b 6c 13 06 06 06 06 06 06 06 |.".}...l........|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 37 5d 52 b5 a7 ae 5e 90 41 3b ba 07 6b ac 99 c3 |7]R...^.A;..k...|
+| df 2c f1 b2 |.,.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45960 found (nil)
+association_find: TCP port 4463 found 0x33292f0
+
+dissect_ssl enter frame #326 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 80 3f 74 e5 3b a0 39 64 10 ea 3c 88 07 0c 79 d5 |.?t.;.9d..<...y.|
+| f1 00 2e 2a 5b 6e 6d 18 d4 b5 e9 85 5c 95 b9 3d |...*[nm.....\..=|
+| 26 23 ec f0 0b 4b 40 ce 5a 31 a9 7c d9 a7 11 6d |&#...K@.Z1.|...m|
+| 14 f7 bd 3a ec ac e7 cd c4 fb 3b 9d 14 2e c4 98 |...:......;.....|
+| 70 4f 4f 87 f4 57 59 79 ec 33 b4 22 6b 36 cf 24 |pOO..WYy.3."k6.$|
+| ad 1e 13 bf 52 38 c3 55 9e ed 34 43 04 c3 d3 4e |....R8.U..4C...N|
+| c1 c9 72 a7 8d 90 31 f2 e1 23 dd 09 16 63 50 b5 |..r...1..#...cP.|
+| fe 73 d3 a8 aa 45 70 7c 1a 5c 09 2d a4 57 47 88 |.s...Ep|.\.-.WG.|
+| a2 97 08 cc 44 5e 7f 8c 41 cb ef 02 33 83 c5 f0 |....D^..A...3...|
+| 10 d3 fb 21 ae 09 15 b7 e4 04 44 b9 40 69 4b 97 |...!......D.@iK.|
+| 34 56 38 5a 9d 9a 0e 0d 72 59 82 21 54 4a 5b 00 |4V8Z....rY.!TJ[.|
+| e9 23 1c 44 c5 8b ed 7b ca 43 af b0 3d 0a 4a 76 |.#.D...{.C..=.Jv|
+| 5c 75 cd 04 c9 8a cc 16 08 da c7 20 44 9b 36 3b |\u......... D.6;|
+| 86 d4 2c 45 07 97 82 b5 f2 bd 8d ec 60 20 5c 88 |..,E........` \.|
+| 79 e7 b5 b0 90 6c fd 6d 59 12 18 ec 06 fa 9e b8 |y....l.mY.......|
+| ac fe 3e 07 45 42 bc f0 71 d8 c7 04 bc 7f 11 fc |..>.EB..q.......|
+| c1 d6 6b fa 1b 80 18 32 87 e4 9a 24 5f 1d 5f 51 |..k....2...$_._Q|
+| 42 8d f7 44 9e 06 1e 2d 3e 64 a4 be 17 05 38 7a |B..D...->d....8z|
+| 35 6c f2 3e 6a a6 82 f8 68 66 e9 95 8d 7d e7 09 |5l.>j...hf...}..|
+| a3 2a 33 3a 57 fa 42 ed b9 c0 f3 d9 c4 26 9d a0 |.*3:W.B......&..|
+| 13 1f de 4e 46 01 f5 f1 7c ac 1f 02 2f 2f d8 4f |...NF...|...//.O|
+| 17 95 56 75 d1 95 0a 01 c3 48 05 2e 3d 11 54 f5 |..Vu.....H..=.T.|
+| 25 58 7b e1 d8 35 a9 93 98 5c 91 a6 da 58 f2 91 |%X{..5...\...X..|
+| 9e f1 d0 e0 bd 76 06 ea e4 e7 66 ab 01 99 af fd |.....v....f.....|
+| ce f5 95 4e ef 40 7a f4 4c bd 39 59 29 a1 1d 7e |...N.@z.L.9Y)..~|
+Plaintext[400]:
+| 39 da 10 18 16 5d da d5 1a 93 51 26 b7 10 25 fa |9....]....Q&..%.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL|
+| 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 4d 20 9d 67 77 69 ef d0 35 d1 eb 1d a1 23 d3 44 |M .gwi..5....#.D|
+| e4 79 3b 4d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.y;M............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6a 8e e9 2a e9 ce 28 ac 0b d3 c7 6a 1d fd ed 93 |j..*..(....j....|
+| b0 10 65 0f |..e. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4463 found 0x33292f0
+
+dissect_ssl enter frame #327 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2f fa 91 20 7b ba 19 80 01 32 8c 17 e0 75 25 41 |/.. {....2...u%A|
+| 41 0c f5 3c 46 bd c2 f3 56 19 92 48 92 f5 57 66 |A..<F...V..H..Wf|
+| aa 2b e6 a2 d9 dd 5e 02 84 89 97 38 b8 ad 28 63 |.+....^....8..(c|
+Plaintext[48]:
+| b3 b5 9f 91 ae 7f 16 e6 2a 6f fc 4e 60 6e 56 e7 |........*o.N`nV.|
+| 01 00 ad 9b 1a 4d cf f3 92 91 78 cd ea bc e2 02 |.....M....x.....|
+| 33 98 af f5 1a 8e 09 09 09 09 09 09 09 09 09 09 |3...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ad 9b 1a 4d cf f3 92 91 78 cd ea bc e2 02 33 98 |...M....x.....3.|
+| af f5 1a 8e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #329 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9a ce 46 29 27 09 b2 14 40 0a a7 b5 c3 e4 a6 00 |..F)'...@.......|
+| 9b ef c7 cd c5 1d f9 8b b7 05 7a 29 43 5d 73 56 |..........z)C]sV|
+| 64 a7 1e 82 13 b7 fd 26 4f c1 dc b5 f0 67 10 ef |d......&O....g..|
+Plaintext[48]:
+| 8b 81 b6 5f f3 26 c3 43 a6 52 d5 e0 91 b9 90 ee |..._.&.C.R......|
+| 01 00 56 96 1b 1c e7 8b 26 a0 89 26 5e ad 69 9d |..V.....&..&^.i.|
+| a7 69 5f 27 ff 83 09 09 09 09 09 09 09 09 09 09 |.i_'............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 56 96 1b 1c e7 8b 26 a0 89 26 5e ad 69 9d a7 69 |V.....&..&^.i..i|
+| 5f 27 ff 83 |_'.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #334 (first time)
+ssl_session_init: initializing ptr 0x7facc3842ab0 size 688
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46494 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4464
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #336 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.|
+| ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U...<b..f&.R4.|
+| 24 28 c1 c4 75 59 4c c2 30 9b ab 49 b8 5e 34 2a |$(..uYL.0..I.^4*|
+| af e5 38 3d 51 a9 74 b4 30 4f d1 45 8b |..8=Q.t.0O.E. |
+hash out[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+PRF out[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+key expansion[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+Client MAC key[20]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed |..B. |
+Server MAC key[20]:
+| f0 32 c0 26 48 8f fb b2 07 51 6d b7 a0 b4 0e ab |.2.&H....Qm.....|
+| bc 15 02 57 |...W |
+Client Write key[32]:
+| 89 8a 79 a6 e2 95 79 3a 0b 06 53 8a 59 5b 25 b3 |..y...y:..S.Y[%.|
+| f2 f6 78 5b d7 2e 1c d6 cc 85 0c a1 2b e5 ea cf |..x[........+...|
+Server Write key[32]:
+| c2 39 41 e4 25 e4 37 33 2c ba fd 95 bc 23 3d 7e |.9A.%.73,....#=~|
+| 80 e2 b9 ad c1 8e 97 45 d8 bc ec e9 54 af e6 03 |.......E....T...|
+Client Write IV[16]:
+| e2 fd 33 7a 84 9e 49 8e 81 a2 63 52 d2 f4 c5 96 |..3z..I...cR....|
+Server Write IV[16]:
+| 76 f9 e2 9e cf b5 fa 1b c9 c2 21 7a c6 0d 29 8e |v.........!z..).|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #338 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51...
+looking for RSA pre-master0080868cbc83906b6ee24c5d9e1ee3ad9985776eaff74dc0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.|
+| ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U...<b..f&.R4.|
+| 24 28 c1 c4 75 59 4c c2 30 9b ab 49 b8 5e 34 2a |$(..uYL.0..I.^4*|
+| af e5 38 3d 51 a9 74 b4 30 4f d1 45 8b |..8=Q.t.0O.E. |
+hash out[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+PRF out[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+key expansion[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+Client MAC key[20]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 |.Q`( |
+Server MAC key[20]:
+| 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa 33 d2 19 11 |UN{..4......3...|
+| aa fb 49 ff |..I. |
+Client Write key[32]:
+| db 90 40 21 34 51 40 e8 6f 43 d9 f2 a0 70 f5 1c |..@!4Q@.oC...p..|
+| 29 d5 18 c4 8f 5c 3a b5 8f 00 82 bc 09 23 38 1c |)....\:......#8.|
+Server Write key[32]:
+| 1e 6d e3 3b ca 9f 06 47 a7 d2 76 55 af 1f 77 eb |.m.;...G..vU..w.|
+| 20 95 5a d8 6e 45 d2 93 7a 51 47 8d e2 18 7e bf | .Z.nE..zQG...~.|
+Client Write IV[16]:
+| 3f b2 d6 da 35 b8 26 89 e6 32 0e 33 5d 7a 1d 7c |?...5.&..2.3]z.||
+Server Write IV[16]:
+| b5 1e 0b 33 cb 8a 17 3d 06 49 69 81 80 13 33 d9 |...3...=.Ii...3.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 91 8f ea bd 78 9b 2c b1 e8 ab 4d f4 f3 78 d4 45 |....x.,...M..x.E|
+| e9 9b 56 b0 c6 50 9d 3f f0 73 0c f4 31 99 22 3b |..V..P.?.s..1.";|
+| ad ae 64 7d e5 9e 64 a9 5b f9 f0 5f a3 64 f7 d3 |..d}..d.[.._.d..|
+| 6e ea 93 ca 69 9d 4e 7d cd 63 51 3e 8a 9b c7 b8 |n...i.N}.cQ>....|
+Plaintext[64]:
+| 26 fc 91 f6 e2 86 7d 37 70 47 3b 54 2b 52 3e c7 |&.....}7pG;T+R>.|
+| 14 00 00 0c fa db c0 11 3f c8 41 79 2c 6e 9b 0c |........?.Ay,n..|
+| 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s|
+| 56 1f 24 47 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |V.$G............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s|
+| 56 1f 24 47 |V.$G |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #339 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f5 02 c7 af 76 da 1d 26 df d0 99 08 80 87 c1 c0 |....v..&........|
+| 06 9f aa ea 77 b7 36 6e c8 4c 24 18 f3 32 26 cf |....w.6n.L$..2&.|
+| b1 7e 07 64 ac 97 32 34 48 84 58 77 5e ce bc 44 |.~.d..24H.Xw^..D|
+| a2 5f 0f c5 c4 a2 cd a9 1d a2 f4 f4 70 47 25 0b |._..........pG%.|
+Plaintext[64]:
+| 77 a0 f2 7d 13 86 ff ad 89 da 5e f6 2e e2 21 89 |w..}......^...!.|
+| 14 00 00 0c e4 6f f6 f8 4f f8 97 6f 90 e1 ae d7 |.....o..O..o....|
+| 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.|
+| 6d ce 01 fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.|
+| 6d ce 01 fc |m... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #340 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 94 69 cf 52 91 aa 64 9a b7 b4 aa a3 73 88 43 d5 |.i.R..d.....s.C.|
+| a1 e0 de 8a 57 e6 fa 44 f0 84 4d c7 0b 5f 77 b7 |....W..D..M.._w.|
+| cd ab d3 12 f4 5f 83 cd dd 07 4a 19 a2 13 0f 5a |....._....J....Z|
+| 8b 89 b9 ed e4 22 5f 15 82 fb 7f 93 26 a1 cf d6 |....."_.....&...|
+| d6 0e 7d dc f9 cc 52 0f d6 bf 75 ad da 43 62 64 |..}...R...u..Cbd|
+| 35 ab 4b 92 23 9b 39 9b bd 85 67 2a 4c c3 c7 5e |5.K.#.9...g*L..^|
+| c1 12 a3 cd 28 42 a1 5a fd f4 ec 4c 65 c1 1b 6b |....(B.Z...Le..k|
+| 6d 3f cf 83 c2 59 b0 91 b2 86 42 83 3e 14 4e 1e |m?...Y....B.>.N.|
+Plaintext[128]:
+| a2 de e4 4e ac eb 71 32 47 25 4c 54 27 c0 03 c3 |...N..q2G%LT'...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a 08 02 fe |n.nl:4464.......|
+| fb 08 70 fa 53 4b fb 93 27 16 f1 77 e1 fd 0a 58 |..p.SK..'..w...X|
+| 32 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |2...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 2c b5 a9 5c 80 e8 38 4f a1 5a 1a cb 97 6e 3e |.,..\..8O.Z...n>|
+| f5 8e 67 dd |..g. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 46494 found (nil)
+association_find: TCP port 4464 found 0x3329380
+
+dissect_ssl enter frame #341 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d1 55 16 ed 01 dc a3 cc db f7 c0 01 9b 99 7b df |.U............{.|
+| 0b d8 37 20 65 cd c4 32 92 44 2b 35 56 fb fe f8 |..7 e..2.D+5V...|
+| 65 c4 b0 d6 af f9 a8 7f a4 cf 85 4b c3 52 7b cc |e..........K.R{.|
+| e1 7d 9c 34 42 77 bd b4 d6 1f 93 8e a5 0f 44 f5 |.}.4Bw........D.|
+| cf 12 e8 d6 ca 71 0a 33 6b 6f c2 17 e7 d0 4b a0 |.....q.3ko....K.|
+| da 67 86 c0 e0 e5 1e d3 4b ef ce 1a c5 a3 8d 49 |.g......K......I|
+| dc 23 48 f9 a6 71 52 9c 90 39 d4 1a 4c c2 ec 85 |.#H..qR..9..L...|
+| 3d 70 25 36 3a ad 94 b4 8b 49 71 54 15 e1 8b 35 |=p%6:....IqT...5|
+| 30 29 a3 d3 38 45 0f 26 94 f2 44 4f 4e 3c b4 97 |0)..8E.&..DON<..|
+| 11 fc c0 96 6d 1e c1 43 87 27 7d 12 72 83 82 99 |....m..C.'}.r...|
+| cd 1e a8 98 fe dd dc 8d 88 31 13 ba 03 d4 fb 34 |.........1.....4|
+| 89 a3 bb ae b9 50 88 83 33 97 60 f6 be b6 09 6c |.....P..3.`....l|
+| 1a cd 72 8c 16 13 b6 3b 25 76 f6 e6 a0 b0 a2 01 |..r....;%v......|
+| 13 02 e9 52 16 55 fd cd a6 7d a1 3b da 07 3d b4 |...R.U...}.;..=.|
+| 80 4a f1 7f f1 6c 87 01 16 2a 13 d6 17 b5 4e fd |.J...l...*....N.|
+| 0c 8d 1c 48 d0 a5 dd ca 88 4e 0b 71 a9 64 fa b2 |...H.....N.q.d..|
+| 72 c6 04 e6 a6 45 21 5f f0 e9 b3 b2 8e 2a 97 01 |r....E!_.....*..|
+| 26 d7 db d0 cb 5e e8 ad 10 67 bc ab 34 aa 22 d1 |&....^...g..4.".|
+| fc 15 a4 69 aa e5 16 60 66 64 b7 2a ba ed 22 32 |...i...`fd.*.."2|
+| ee ce 25 67 59 51 01 ca c0 fe 83 45 e0 13 30 d1 |..%gYQ.....E..0.|
+| 03 2c 70 83 6c 78 dc 05 3f 9a 24 db fa 5a 79 93 |.,p.lx..?.$..Zy.|
+| ad 24 37 79 03 b5 0a 7c 9d 70 0e 27 4f c6 df 49 |.$7y...|.p.'O..I|
+| 75 48 17 1b d4 f9 c4 ee f6 0e 25 5b 3c 3c ee 24 |uH........%[<<.$|
+| e0 db 23 6b d1 6f f3 70 fa b9 e4 6a bb b5 19 be |..#k.o.p...j....|
+| 82 2a b9 1c 42 59 6d b3 34 0f b1 3e ce fa f3 3c |.*..BYm.4..>...<|
+Plaintext[400]:
+| 56 d8 90 48 74 3a cb a2 26 96 76 52 d3 2a d7 62 |V..Ht:..&.vR.*.b|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 9d 2f 0f ef c7 0f ce 43 a6 ee 38 8b 89 9c c5 fc |./.....C..8.....|
+| e0 9c e3 d2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c ef 7b 0c b7 61 63 78 62 4a 31 d9 d5 9c f5 fe |..{..acxbJ1.....|
+| 8c 51 93 86 |.Q.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4464 found 0x3329380
+
+dissect_ssl enter frame #342 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 73 c0 6a d0 83 12 3f 6c 73 dd 27 97 76 e3 58 11 |s.j...?ls.'.v.X.|
+| f5 5d 87 8d 64 29 4d c5 83 93 55 43 2c 8b 72 fa |.]..d)M...UC,.r.|
+| c4 da 78 2c 9b a1 ee d5 8d 38 da d6 27 ce ee 88 |..x,.....8..'...|
+Plaintext[48]:
+| 39 d2 ca 89 a0 d7 8f db 1c ab 32 e6 34 ad 7f 5d |9.........2.4..]|
+| 01 00 bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 |......>.X..^....|
+| f4 fe aa 02 19 7f 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 f4 fe |....>.X..^......|
+| aa 02 19 7f |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #344 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c2 9c 16 b7 51 d3 f3 82 ab 81 37 5d 14 01 60 7a |....Q.....7]..`z|
+| d6 c0 f6 e8 3c 17 5d 4a 61 ab 32 2e 11 19 49 00 |....<.]Ja.2...I.|
+| dd 61 dc 76 38 55 06 ae 41 9e de f4 74 70 f3 4e |.a.v8U..A...tp.N|
+Plaintext[48]:
+| 4b b8 f2 c8 d7 66 d7 59 07 9f 04 af 0d 1f 56 16 |K....f.Y......V.|
+| 01 00 f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be |....Iv!...{F....|
+| db be 97 91 fc 8d 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be db be |..Iv!...{F......|
+| 97 91 fc 8d |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #349 (first time)
+ssl_session_init: initializing ptr 0x7facc3844ff0 size 688
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56836 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4465
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #351 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%|
+| b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.|
+| 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..|
+| 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... |
+hash out[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+PRF out[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+key expansion[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+Client MAC key[20]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b |../; |
+Server MAC key[20]:
+| f1 10 84 e3 4b 5b 18 1a c2 93 19 dd 25 ae e3 68 |....K[......%..h|
+| bf 0f e0 03 |.... |
+Client Write key[32]:
+| c5 69 45 6d da 9d 43 ef 3d e5 25 ac 87 ec 10 ca |.iEm..C.=.%.....|
+| d6 58 dd 57 6a 3e 8b 0c 1e 44 44 27 68 0e 21 e1 |.X.Wj>...DD'h.!.|
+Server Write key[32]:
+| 2a 47 27 f8 df 6b 86 b7 80 cd 51 e2 cb 52 2f 43 |*G'..k....Q..R/C|
+| 86 61 e4 42 d7 72 2b 05 55 89 70 37 79 dc d0 8b |.a.B.r+.U.p7y...|
+Client Write IV[16]:
+| 88 d8 45 5a 2c d1 f4 d2 db 96 a2 be af d9 c4 1c |..EZ,...........|
+Server Write IV[16]:
+| 35 9c 36 26 b3 31 72 fb 4c 16 bc 06 78 d2 25 bc |5.6&.1r.L...x.%.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #353 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9...
+looking for RSA pre-master008078d26263650f6ddf092133c693e2b2727a3db5f9f9d5...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%|
+| b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.|
+| 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..|
+| 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... |
+hash out[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+PRF out[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+key expansion[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+Client MAC key[20]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 |7.bE |
+Server MAC key[20]:
+| c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 1c 90 8c 96 |.^.......}.X....|
+| aa d3 e4 c1 |.... |
+Client Write key[32]:
+| c4 83 81 78 13 b0 fe db 15 f3 3b dc a7 da 98 12 |...x......;.....|
+| 2f 97 75 23 1c 00 f4 28 5e c2 2e 5c 1b c4 c7 60 |/.u#...(^..\...`|
+Server Write key[32]:
+| e1 9b b8 54 4b 25 6f 06 3c 22 f3 3b c3 fc 2d a1 |...TK%o.<".;..-.|
+| 88 13 85 f6 39 53 5c c1 15 b8 90 a4 7a 16 4c 18 |....9S\.....z.L.|
+Client Write IV[16]:
+| 94 f4 1b 79 a4 09 5a 61 01 11 50 8c ca 6d df a4 |...y..Za..P..m..|
+Server Write IV[16]:
+| 4a 3c 2a 9a 34 cb 52 07 6b ad bc c7 6e 26 de 14 |J<*.4.R.k...n&..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fa 68 d8 87 92 30 22 84 16 34 84 dd 38 e6 1d 34 |.h...0"..4..8..4|
+| 14 ab 5e 86 34 b8 f3 df 6c 43 05 bb 31 1c 09 a8 |..^.4...lC..1...|
+| 56 8a 1a 21 88 32 ef 18 e1 b7 53 c4 31 95 69 ea |V..!.2....S.1.i.|
+| da b8 42 cc d6 1b ec 7a eb 86 c5 3a 0f 2b 58 69 |..B....z...:.+Xi|
+Plaintext[64]:
+| 4b b8 fa 75 08 4a 3f a9 c8 db 63 5d 13 5a 69 5d |K..u.J?...c].Zi]|
+| 14 00 00 0c ae e2 6a 45 89 9e 66 35 23 cf 96 21 |......jE..f5#..!|
+| bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.|
+| 1e 26 31 4a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.&1J............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.|
+| 1e 26 31 4a |.&1J |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #354 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 40 79 2f 88 65 aa f4 a1 4f dd 22 db f8 2b 5d f0 |@y/.e...O."..+].|
+| 9c 00 d4 0c e8 14 b1 79 9f a7 35 64 96 a0 a6 74 |.......y..5d...t|
+| 14 3d f5 b1 2d 07 79 9e bd ac b1 c4 fc 31 ce b9 |.=..-.y......1..|
+| 57 91 ad 39 f0 8e c6 82 25 39 1e d4 3c 28 11 4c |W..9....%9..<(.L|
+Plaintext[64]:
+| f9 8c 08 20 64 18 84 fb cf b0 01 9f 18 29 aa 5c |... d........).\|
+| 14 00 00 0c e0 07 f0 70 10 cf 3e af 77 24 da 12 |.......p..>.w$..|
+| 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..|
+| bd 87 0e 8d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..|
+| bd 87 0e 8d |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #355 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 55 f0 1a 31 5e cb a0 5b 0f 9f e1 bd 94 ce 47 5d |U..1^..[......G]|
+| d9 d2 82 de 4a 62 4c 6b 65 dd 66 cb 40 d5 f7 38 |....JbLke.f.@..8|
+| 2f 6f 54 fa a8 c7 b6 c8 1d 0c 0f 9d 60 67 a6 53 |/oT.........`g.S|
+| c5 f3 f2 de e7 11 04 6f 18 28 b7 b5 da a9 04 e2 |.......o.(......|
+| 16 04 0a 90 7c 37 1e e7 d3 be f6 53 ad 43 c0 53 |....|7.....S.C.S|
+| 1c 1d 73 2d f6 39 6d b5 00 bc 9d 92 0b d7 7b 57 |..s-.9m.......{W|
+| ee 50 fd bc 91 c3 07 56 99 2b 2d 39 74 21 ff 16 |.P.....V.+-9t!..|
+| 4f 74 6b 4b e6 ce 12 ad 23 cf b7 22 22 3e a9 53 |OtkK....#.."">.S|
+Plaintext[128]:
+| 80 b2 67 f2 b3 04 ab 90 ba d6 20 26 56 47 bd ed |..g....... &VG..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a c5 76 a8 |n.nl:4465.....v.|
+| fc 7c d4 c7 4d 40 29 77 4d d9 68 ab 41 94 9f 1e |.|..M@)wM.h.A...|
+| b8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 07 5a 3d 9b 9c ce c4 b8 21 60 01 ac 95 56 e4 54 |.Z=.....!`...V.T|
+| ea cd 30 7c |..0| |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56836 found (nil)
+association_find: TCP port 4465 found 0x3329410
+
+dissect_ssl enter frame #356 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| dd 3e f4 66 f9 61 9d 1d 08 21 c1 62 e5 32 b5 30 |.>.f.a...!.b.2.0|
+| bd 82 65 ba 66 86 cf 43 09 33 8d 02 0c 31 31 d4 |..e.f..C.3...11.|
+| 6e fa c6 2a b8 88 1f ce 0b 74 5c f8 fd 4e 89 22 |n..*.....t\..N."|
+| eb ab f1 3a eb e4 9b 2b 6f 78 c9 99 1c 92 5c 20 |...:...+ox....\ |
+| bb 71 f1 85 11 af df e0 71 a7 9a bd 4f 51 14 74 |.q......q...OQ.t|
+| d8 6e 9c 02 4e e6 ae 77 29 cf c7 08 59 15 2b 76 |.n..N..w)...Y.+v|
+| 2c 62 6c 43 1c 8e e4 c9 17 c0 53 6e 2f 20 d8 a1 |,blC......Sn/ ..|
+| 12 c0 5b 72 40 9d 7b 9e 2f ac 4f 79 2e 2e dd 45 |..[r@.{./.Oy...E|
+| 84 2d 26 b0 c4 3a 4e ca 97 ef 69 bf d8 97 7b ce |.-&..:N...i...{.|
+| e5 a0 25 24 43 7c 2f 47 a0 17 5b 78 8e ca 01 8c |..%$C|/G..[x....|
+| a2 9c fa fa 08 94 33 96 da 3d b9 ae 49 01 6d 30 |......3..=..I.m0|
+| ea 40 1e 4a 9b 89 d5 df a9 0c bd 16 c9 ac ed a5 |.@.J............|
+| ce e8 7f cd 99 21 cf 62 bc e1 c3 23 a8 07 89 b6 |.....!.b...#....|
+| 9d 7e ca c3 ee 0b ef bf 43 2f 7b e1 16 9b aa 77 |.~......C/{....w|
+| ee 30 f3 21 be 4c ca c7 8a 5c 2d c9 80 bd 16 9f |.0.!.L...\-.....|
+| b6 04 60 5f 39 a3 01 76 f6 c1 15 ce 2f 82 a7 15 |..`_9..v..../...|
+| 5e 5b 58 a8 c2 32 a9 33 3d 4a e2 fd 24 ea d2 18 |^[X..2.3=J..$...|
+| de eb 2d 4f a1 90 53 ac 49 86 bd c1 62 01 40 10 |..-O..S.I...b.@.|
+| 12 59 11 18 a5 ba 33 4b cd c2 1b d4 82 8c 06 cf |.Y....3K........|
+| 60 3d c1 5b 11 3a 02 7d f6 94 42 a5 48 c5 d1 97 |`=.[.:.}..B.H...|
+| b8 db 48 8f 3e 98 f2 98 fd 3a 6b e7 dc 8d ac ce |..H.>....:k.....|
+| f2 db b9 ac 88 59 ca be b4 34 37 69 9b 5b 89 08 |.....Y...47i.[..|
+| bb 3c 4b 27 ec 63 80 57 a2 2f 83 e1 9c 39 03 e8 |.<K'.c.W./...9..|
+| b5 2d 75 e2 dd 0c 7a 10 10 e8 57 5f a1 50 34 d7 |.-u...z...W_.P4.|
+| a4 b1 43 29 c6 6d 87 f0 10 9b 92 41 2d 0b f7 1f |..C).m.....A-...|
+Plaintext[400]:
+| e9 a6 ab 78 e3 ee 73 8e ce ba e2 cc c9 31 10 c6 |...x..s......1..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| df dd 36 53 be 4b 2a cf 0a 54 8d 28 4d d0 04 b9 |..6S.K*..T.(M...|
+| 08 a2 a5 5a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...Z............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f0 53 9d 53 d1 18 af 29 fc eb 69 68 7f 79 c0 f6 |.S.S...)..ih.y..|
+| e8 33 66 a2 |.3f. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4465 found 0x3329410
+
+dissect_ssl enter frame #357 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c8 8e 52 02 bd ce d2 61 53 4d 77 13 e2 40 96 43 |..R....aSMw..@.C|
+| 8f c1 c7 ff 36 8c 11 d7 e4 5a 15 4c e3 5c 55 f1 |....6....Z.L.\U.|
+| e7 f1 01 6a c5 99 be e3 b9 aa 46 83 00 6b 4e f6 |...j......F..kN.|
+Plaintext[48]:
+| 04 e1 12 3e a1 e8 f2 c9 6d 92 92 9a 0b 52 3f f3 |...>....m....R?.|
+| 01 00 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb |..Ae..V.f...,.}.|
+| 17 8e 07 36 0a b1 09 09 09 09 09 09 09 09 09 09 |...6............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb 17 8e |Ae..V.f...,.}...|
+| 07 36 0a b1 |.6.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #359 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 51 75 5c 7b 36 f1 13 5d 48 b0 c7 5b 00 41 13 19 |Qu\{6..]H..[.A..|
+| 76 23 60 e7 84 47 b8 75 02 e6 b6 79 8b fd a0 83 |v#`..G.u...y....|
+| e6 b6 b0 79 22 78 99 6a 4a 84 96 dd 39 12 81 93 |...y"x.jJ...9...|
+Plaintext[48]:
+| d3 8f a5 ef 2f 32 a0 8d b2 9a a1 50 91 a7 6f 52 |..../2.....P..oR|
+| 01 00 ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 |......2.~.#-|.I1|
+| 08 18 ea 38 7c 53 09 09 09 09 09 09 09 09 09 09 |...8|S..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 08 18 |....2.~.#-|.I1..|
+| ea 38 7c 53 |.8|S |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #364 (first time)
+ssl_session_init: initializing ptr 0x7facc38474f0 size 688
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47180 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4470
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #366 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u|
+| cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.|
+| 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=|
+| 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 |
+hash out[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+PRF out[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+key expansion[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+Client MAC key[20]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 |r..% |
+Server MAC key[20]:
+| 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 a7 8f 41 03 |{.T.]D4..T....A.|
+| e9 93 27 bc |..'. |
+Client Write key[16]:
+| 9d 6b 12 30 1c 83 09 e4 a3 43 66 3e a5 fd 38 bf |.k.0.....Cf>..8.|
+Server Write key[16]:
+| 93 58 00 eb 36 6c 2c b3 9a 74 e3 7f bc b3 0c 1a |.X..6l,..t......|
+Client Write IV[16]:
+| 6a 2b 62 83 c0 5a 36 de 50 3b 19 5f 65 0c 6c fa |j+b..Z6.P;._e.l.|
+Server Write IV[16]:
+| b1 15 af 88 ba 6a d2 66 db 34 79 4e b3 9c 6f d9 |.....j.f.4yN..o.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #368 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d9035104154...
+looking for RSA pre-mastera08f474c2a890fc66f808400c49cc26c2804ab7db0a99844...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u|
+| cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.|
+| 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=|
+| 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 |
+hash out[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+PRF out[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+key expansion[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+Client MAC key[20]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef |rox. |
+Server MAC key[20]:
+| c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 fc 56 c8 01 |.r....!.#,...V..|
+| ac 8d d6 c1 |.... |
+Client Write key[16]:
+| bf 4e 2c c4 72 43 70 ea d0 b9 89 95 51 41 a8 27 |.N,.rCp.....QA.'|
+Server Write key[16]:
+| 68 1b 3b d2 8c 6b 70 73 e4 01 07 8e 68 8a 9f 09 |h.;..kps....h...|
+Client Write IV[16]:
+| ea 32 9d fb 23 54 37 bb d3 c8 ee db 13 f2 47 b7 |.2..#T7.......G.|
+Server Write IV[16]:
+| 3d 5d 77 94 97 f9 15 81 05 99 dd 6a 67 6a 9f 05 |=]w........jgj..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cd 79 dc 6f 62 fe 21 70 42 98 f6 48 e3 dd 80 71 |.y.ob.!pB..H...q|
+| f6 3f f8 59 ae 63 9d f0 69 7b 35 0d 8d d0 f0 28 |.?.Y.c..i{5....(|
+| df 91 4b 54 d7 76 fb d8 e7 5c 84 b0 a8 0f 6f af |..KT.v...\....o.|
+| 32 0d 65 32 a3 dd df 69 7d d3 79 c2 9c 2f 42 a5 |2.e2...i}.y../B.|
+Plaintext[64]:
+| 75 c8 e5 2e 3b 86 34 97 78 25 d2 5e 11 76 82 d4 |u...;.4.x%.^.v..|
+| 14 00 00 0c 88 2d 25 c6 b2 df f9 6e 7b a6 86 5d |.....-%....n{..]|
+| e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I|
+| 7e ca fe 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |~...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I|
+| 7e ca fe 05 |~... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #369 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f1 0a f2 a7 2e cc 2e 26 d7 f4 5c eb fd bc d6 ee |.......&..\.....|
+| b6 5a 36 1f 57 05 a1 72 a3 50 cc 99 df 24 2a 1b |.Z6.W..r.P...$*.|
+| e6 95 35 30 b1 5a 6a f1 84 2d e0 89 e8 95 0a c7 |..50.Zj..-......|
+| 47 08 e8 27 ab 7b 3d 3e a9 80 f9 0a 7d 1c 27 56 |G..'.{=>....}.'V|
+Plaintext[64]:
+| 9d e9 d9 96 dd a2 da 36 b5 13 46 ca 82 cd c3 21 |.......6..F....!|
+| 14 00 00 0c 86 b5 73 c1 67 fb a0 66 d0 7f b5 c5 |......s.g..f....|
+| 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...|
+| 8d fd a0 4e 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...N............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...|
+| 8d fd a0 4e |...N |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #370 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 68 4a b6 73 42 99 a4 45 24 9b eb 56 6e 8d d8 a0 |hJ.sB..E$..Vn...|
+| 27 bc f4 56 84 c5 bc b3 df 25 60 80 3f fb be d4 |'..V.....%`.?...|
+| b7 f4 33 ed 5d 4b e1 06 cb b7 9b cd d8 04 d2 79 |..3.]K.........y|
+| d4 3e 1b c9 cf db 06 96 56 64 aa 35 0e 2a 33 1c |.>......Vd.5.*3.|
+| 81 bb 4a 37 60 b7 47 7f dc 45 c8 ba 7a 59 6e fb |..J7`.G..E..zYn.|
+| e1 1c e0 c3 f9 f0 5d d0 9d f0 a3 17 cb de 05 94 |......].........|
+| 82 94 03 81 26 51 0e 5e 8e 2f 41 00 fd 90 58 88 |....&Q.^./A...X.|
+Plaintext[112]:
+| d6 f4 8d 74 4f a9 b4 d7 46 26 79 2b a1 bb f5 d7 |...tO...F&y+....|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a 03 a3 |yn.nl:4470......|
+| 54 92 72 54 37 8d ad 36 33 26 d3 0e 22 e3 ce c5 |T.rT7..63&.."...|
+| 34 d4 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |4...............|
+ssl_decrypt_record found padding 13 final len 98
+checking mac (len 62, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3c 35 f7 17 1d ca 6f e5 3b b6 d6 90 9e cb af f4 |<5....o.;.......|
+| 49 f6 4b 4c |I.KL |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47180 found (nil)
+association_find: TCP port 4470 found 0x33cdf40
+
+dissect_ssl enter frame #371 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fa d6 df 69 e5 8b 28 37 ec b4 85 9c 85 99 03 cd |...i..(7........|
+| e1 06 72 7e fe 3b 55 39 53 a5 c3 12 53 b7 50 43 |..r~.;U9S...S.PC|
+| 22 39 a5 c5 d9 f5 e4 10 ca 36 e3 23 e9 f0 52 c0 |"9.......6.#..R.|
+| c9 d7 4e 62 a7 41 49 46 a0 87 3f 93 bc 2e d1 6a |..Nb.AIF..?....j|
+| 15 f7 1f 76 54 41 74 89 28 b9 9d f9 7e 50 91 a7 |...vTAt.(...~P..|
+| 65 cc a2 b5 7e d1 0e 2c 54 bf 4b f6 06 bb 78 d7 |e...~..,T.K...x.|
+| d5 4d 82 21 f9 41 3a 6c fa c4 20 4b 55 b1 a5 c5 |.M.!.A:l.. KU...|
+| e0 50 92 f3 e2 03 e4 2b 90 8c 50 f7 b5 ef 1a 16 |.P.....+..P.....|
+| ea c2 7f 2b a2 a0 d8 ae bc 0b 8f 39 c9 9b ad 93 |...+.......9....|
+| 8d ca cf 99 e7 58 a7 98 1c fd a8 e4 ac d1 c0 ac |.....X..........|
+| c8 b4 a6 ea 4d 12 34 9b 1e 73 ed 25 62 df 91 47 |....M.4..s.%b..G|
+| da 5a 4d be 04 b3 d0 e9 d6 8f 2e bf 91 01 59 68 |.ZM...........Yh|
+| e6 9d 96 74 64 a3 84 dd 9d 1b 1d 8e 37 ef b4 8f |...td.......7...|
+| 8d 74 65 45 74 35 6e a0 00 b0 fe d4 48 38 3f 95 |.teEt5n.....H8?.|
+| 2f ad 20 d8 2e 30 79 2f 0f 26 8d 11 a6 35 bf 30 |/. ..0y/.&...5.0|
+| 8b 6a f3 17 bf 50 c6 53 74 44 5e d5 55 4f 64 46 |.j...P.StD^.UOdF|
+| 17 57 ca 1e 2a ad 5f 07 a4 df 91 3d af 66 54 69 |.W..*._....=.fTi|
+| ec e8 a2 e4 1a f1 3a 93 9c 23 3d 07 8b 51 f8 72 |......:..#=..Q.r|
+| 61 56 16 a9 79 87 09 f6 d7 16 a6 bb f3 9d fd e9 |aV..y...........|
+| e1 ad 5c 5f da fb fb 28 b9 da ec b9 cb 94 71 86 |..\_...(......q.|
+| 4f 5f bd d6 6d cd 83 44 55 4e 6f b0 fd eb 57 ed |O_..m..DUNo...W.|
+| df bc 1b fb c2 53 d0 20 0e 2c fc e8 16 e1 e7 c4 |.....S. .,......|
+| ba f0 51 3b 25 94 13 61 b0 de 39 14 ca a9 a4 f3 |..Q;%..a..9.....|
+| 93 44 1f 92 45 56 01 cf 55 c1 0f 94 7e e3 90 aa |.D..EV..U...~...|
+| 8a 1a de 0f 84 ad 4c 6a 50 8c 04 f3 7c ea ec 55 |......LjP...|..U|
+Plaintext[400]:
+| 3c d3 5c f5 f3 f1 a3 70 18 cf 03 31 81 3f 6b 8d |<.\....p...1.?k.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-|
+| 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ff fb 5d c9 |nl'</script>..].|
+| 6b 40 e2 98 6c b4 36 d8 4e f5 dc 4b b6 1c dc c6 |k@..l.6.N..K....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 17 da a6 c8 e4 c3 71 ee 5d 95 dc 2f 2e 61 92 85 |......q.]../.a..|
+| 88 69 73 be |.is. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4470 found 0x33cdf40
+
+dissect_ssl enter frame #372 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 29 d1 08 9f 3d 50 58 b8 93 19 50 63 17 f3 74 aa |)...=PX...Pc..t.|
+| 66 d0 fb b3 3e b5 82 e6 ab 09 c7 87 60 41 55 d3 |f...>.......`AU.|
+| 65 fc d7 d8 ec ac 55 22 f7 62 85 de 5e f0 41 cf |e.....U".b..^.A.|
+Plaintext[48]:
+| df 60 4b 7a 98 c5 58 04 db a4 d9 da a8 99 7e 22 |.`Kz..X.......~"|
+| 01 00 de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c |....E.T.!..vj...|
+| 6c 8a 69 44 59 48 09 09 09 09 09 09 09 09 09 09 |l.iDYH..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c 6c 8a |..E.T.!..vj...l.|
+| 69 44 59 48 |iDYH |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #374 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 78 f0 bb 1a 01 43 9e d6 0b 7c 86 c9 8e 7f ab 74 |x....C...|.....t|
+| c2 2e ad 47 19 29 7d e1 65 28 c7 88 4a 79 a5 80 |...G.)}.e(..Jy..|
+| f0 01 ea c4 e7 e5 5e 37 e7 3e 38 06 89 e2 59 56 |......^7.>8...YV|
+Plaintext[48]:
+| 14 9f f6 9d 8b 3b a1 96 25 5e c2 de 2d 63 cd d2 |.....;..%^..-c..|
+| 01 00 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b |..S..K ......>.+|
+| c5 f9 5a f4 da 38 09 09 09 09 09 09 09 09 09 09 |..Z..8..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b c5 f9 |S..K ......>.+..|
+| 5a f4 da 38 |Z..8 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #379 (first time)
+ssl_session_init: initializing ptr 0x7facc3849ab0 size 688
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60473 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4471
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #381 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........|
+| c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.|
+| 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....|
+| a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. |
+hash out[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+PRF out[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+key expansion[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+Client MAC key[20]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d |...- |
+Server MAC key[20]:
+| 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 ad 35 e1 1c |.H.K..5....x.5..|
+| db 56 e9 82 |.V.. |
+Client Write key[16]:
+| 70 1c 36 6f 88 ae 80 0d c7 1b a9 4b 1c ae 21 8c |p.6o.......K..!.|
+Server Write key[16]:
+| 46 ca 70 dd d9 22 f3 1d 97 bc 64 b2 6a af 24 bb |F.p.."....d.j.$.|
+Client Write IV[16]:
+| 32 8c b6 9a be 40 fb fd 89 a4 e7 88 11 eb f4 03 |2....@..........|
+Server Write IV[16]:
+| bf b2 c3 a2 08 5b 76 6e a1 1a 51 b7 c4 e7 21 9e |.....[vn..Q...!.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #383 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f227...
+looking for RSA pre-master0080925605454b9461199474e97c5f8964d84e2a5400fc5d...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........|
+| c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.|
+| 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....|
+| a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. |
+hash out[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+PRF out[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+key expansion[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+Client MAC key[20]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 |..&. |
+Server MAC key[20]:
+| c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 44 e4 7c 70 |....i....i.(D.|p|
+| 3a 85 4f 59 |:.OY |
+Client Write key[16]:
+| 04 15 14 3e 42 6b fd a4 b4 e9 d4 6e d7 19 06 1f |...>Bk.....n....|
+Server Write key[16]:
+| a3 fe 96 1d 1d 6d 8a fa 0e d2 6a da 98 44 0e b0 |.....m....j..D..|
+Client Write IV[16]:
+| cb 8c a8 48 21 79 92 d1 a7 8b 66 50 43 1c 12 3c |...H!y....fPC..<|
+Server Write IV[16]:
+| 3c 6c b8 08 b4 e7 5c 8a 52 0e ad 3d 4d c2 44 6a |<l....\.R..=M.Dj|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| ff fa 82 b0 4d 30 fe 55 33 2f 68 3c a2 4f 8b 45 |....M0.U3/h<.O.E|
+| 0c a0 90 8c 9a 8a 1e b7 76 cd 38 c0 a8 e9 a3 0b |........v.8.....|
+| 6d ac 88 95 50 c1 c5 9c c3 69 ef d9 7c bd d3 8e |m...P....i..|...|
+| 91 a3 60 5d 8e fc b6 b6 93 7c db 9a 59 ba f4 06 |..`].....|..Y...|
+Plaintext[64]:
+| fc f0 34 98 a0 90 d3 43 7b 98 e4 5f c5 9f 40 ce |..4....C{.._..@.|
+| 14 00 00 0c 25 8d d0 f4 43 f4 19 c7 70 b6 b4 72 |....%...C...p..r|
+| d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV|
+| 0d 3c f3 1d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.<..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV|
+| 0d 3c f3 1d |.<.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #384 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cc 70 11 57 0b f2 6c b9 05 43 60 3d 36 a3 fc e6 |.p.W..l..C`=6...|
+| a2 1d 20 67 b7 3b fc 53 dc 60 45 82 38 cc 1b 21 |.. g.;.S.`E.8..!|
+| 8d d1 32 83 c8 2a 8b 18 39 1e 04 80 74 81 53 44 |..2..*..9...t.SD|
+| 85 36 24 9f 5f 69 67 77 f5 b1 7c 18 06 c8 fe f8 |.6$._igw..|.....|
+Plaintext[64]:
+| c8 6b 4d 2b 1b 1c 96 d4 fb 98 5a b0 ff 7e 3f 79 |.kM+......Z..~?y|
+| 14 00 00 0c cc 5e 9b 8a 33 ee 1a 9f a2 82 d0 e8 |.....^..3.......|
+| c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...|
+| 53 f0 48 5d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |S.H]............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...|
+| 53 f0 48 5d |S.H] |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #385 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| c1 81 85 64 bb 14 3a 97 60 53 86 5e c8 9a 0c 0a |...d..:.`S.^....|
+| 68 87 74 3d 5f 3d 0e 66 ea bc c6 00 15 7a 7a c5 |h.t=_=.f.....zz.|
+| ca ae 14 01 92 a3 7e ee 19 a4 b3 55 02 eb 82 23 |......~....U...#|
+| 76 bb 48 c9 02 f0 20 48 72 ba f7 0f af ea d7 a2 |v.H... Hr.......|
+| 7f 3d b3 34 8f be 50 2c 98 15 18 ec 5d ab 65 66 |.=.4..P,....].ef|
+| a3 e7 f2 27 3a 79 6a 32 be 9c cc 64 ea 9d 4f 50 |...':yj2...d..OP|
+| 87 b2 94 80 1f 05 f5 4d 40 33 ac e4 58 34 5b ca |.......M@3..X4[.|
+Plaintext[112]:
+| f4 97 05 81 29 29 0f cc f5 ab 32 b4 73 2d b1 5a |....))....2.s-.Z|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 31 0d 0a 0d 0a 0e 3a 04 3b 3b f8 a8 df d4 b4 |71.....:.;;.....|
+| 88 aa d0 77 2a dc ac 4b ac 12 05 05 05 05 05 05 |...w*..K........|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d b4 26 3e bf 0e 09 4c 6d a5 46 ed 83 88 23 bd |..&>...Lm.F...#.|
+| 05 43 5f 20 |.C_ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60473 found (nil)
+association_find: TCP port 4471 found 0x33cdfd0
+
+dissect_ssl enter frame #386 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 75 c6 d3 7c b8 4d 66 cc fd 0e ed 2f 37 3f 64 04 |u..|.Mf..../7?d.|
+| 6f 75 bf 54 5d a0 eb 02 7f 23 75 4f 2c 1c 26 d3 |ou.T]....#uO,.&.|
+| 3c db e8 c2 69 b2 d6 de 21 20 22 6e e2 7e e4 fc |<...i...! "n.~..|
+| f3 1d 5a 8a 59 12 96 42 1d ad e0 87 b8 0e fb 86 |..Z.Y..B........|
+| 3f ff dd b3 98 42 c3 98 27 df 79 b9 d9 bb b5 bb |?....B..'.y.....|
+| 3b d6 cd 23 fc a7 67 a8 cb 76 c0 30 ce bc 3a 8b |;..#..g..v.0..:.|
+| 62 82 0d 72 ef 85 e8 81 9e 30 6d 89 4f c0 b2 d1 |b..r.....0m.O...|
+| 2d ac f2 40 1c 94 87 1d 7b aa 28 d2 f9 dc f2 41 |-..@....{.(....A|
+| 82 7f be b6 84 c3 30 e6 9f 6d 3a c0 bd 7f 72 44 |......0..m:...rD|
+| 31 ef 41 8f 99 9f a0 1e 63 01 d6 55 12 f6 d7 a4 |1.A.....c..U....|
+| aa 25 6d d4 31 fc 23 f8 55 20 6e 8d 0d 16 53 de |.%m.1.#.U n...S.|
+| 96 cb 5d 8b 9f 6e 96 cf ff f1 ad 24 ac f4 06 49 |..]..n.....$...I|
+| b2 c6 86 a0 d6 50 7e e1 3c fb fb ca bc 05 c9 7b |.....P~.<......{|
+| 03 11 de a3 14 ff 96 9d 67 6c 2e 2a 36 95 c3 4c |........gl.*6..L|
+| c2 d7 3b b0 cd 62 b5 6b 3c 51 07 c4 61 ab 75 45 |..;..b.k<Q..a.uE|
+| ff 9e 7c 2f 79 a7 f9 df 15 f7 02 97 31 a4 ad 83 |..|/y.......1...|
+| 3a 7b 5a 2d 9b ec 1f ad 98 12 be 81 57 8e 64 ff |:{Z-........W.d.|
+| 25 15 00 cb d3 01 21 7d ea 9a 29 65 7f 32 fb ea |%.....!}..)e.2..|
+| bd 39 67 4d 3a c7 88 89 81 f6 74 de 81 a0 44 56 |.9gM:.....t...DV|
+| 39 36 cb 39 64 b2 00 1c b4 7a f3 58 b3 f2 6d 55 |96.9d....z.X..mU|
+| 7f 63 4f 79 ba ed f3 d9 b4 20 11 69 2e 8f c4 8b |.cOy..... .i....|
+| e9 09 2f f0 73 2c af 05 10 7d 1e c3 e5 fe fa 65 |../.s,...}.....e|
+| 50 7a ee 76 6f 15 f9 5a ba c8 d4 ee a3 24 a2 7d |Pz.vo..Z.....$.}|
+| cd 1a 37 fe ed 91 6e 83 9d ab 2c 36 8f 5b 8a e1 |..7...n...,6.[..|
+| 52 ec a3 3e 99 c0 82 17 d1 be dc 45 94 49 2c bb |R..>.......E.I,.|
+Plaintext[400]:
+| 7c 8f 27 4e 03 ee 85 93 f7 84 8c 63 b1 ce 76 b9 ||.'N.......c..v.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D|
+| 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d1 4b 51 f6 |nl'</script>.KQ.|
+| c3 46 f0 aa dd 25 f0 d7 8e 38 f6 d5 1c aa 18 fc |.F...%...8......|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 94 66 a7 19 1d 91 b9 b4 22 ed ff 59 95 af c0 15 |.f......"..Y....|
+| 86 55 bf a3 |.U.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4471 found 0x33cdfd0
+
+dissect_ssl enter frame #387 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d8 68 1f b9 e4 9b 0e 10 d9 e3 a4 30 b4 95 28 96 |.h.........0..(.|
+| 1d 06 0e 7c 68 38 00 b8 8f 16 94 92 3e f8 63 0e |...|h8......>.c.|
+| 2d 27 a7 ff 18 36 bf c4 d6 6b 97 3e 7e 30 89 ab |-'...6...k.>~0..|
+Plaintext[48]:
+| 60 d1 c3 db e5 ef d9 6b 2d 2b 9e e4 93 15 09 66 |`......k-+.....f|
+| 01 00 cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f |.....P...n.E.).O|
+| 65 10 31 4f 32 2d 09 09 09 09 09 09 09 09 09 09 |e.1O2-..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f 65 10 |...P...n.E.).Oe.|
+| 31 4f 32 2d |1O2- |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #389 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d6 cc 07 ba ea 03 7d 68 7c f0 7b ce 4a b4 ed 5b |......}h|.{.J..[|
+| bd e7 c5 32 ff 88 d6 b4 6e af ad 92 9d fe ec 41 |...2....n......A|
+| d2 8f 4c de 30 90 7b 28 7a 1b 1d 96 c7 42 e4 c5 |..L.0.{(z....B..|
+Plaintext[48]:
+| 02 bc 99 84 e6 6f 25 d5 5a 8a bb d5 6c 5e f2 d7 |.....o%.Z...l^..|
+| 01 00 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 |..l3:j>..,o..q.E|
+| a2 fd 84 e0 39 58 09 09 09 09 09 09 09 09 09 09 |....9X..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 a2 fd |l3:j>..,o..q.E..|
+| 84 e0 39 58 |..9X |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #394 (first time)
+ssl_session_init: initializing ptr 0x7facc384bfb0 size 688
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34652 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4472
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #396 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;|
+| e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.|
+| 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.|
+| 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. |
+hash out[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+PRF out[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+key expansion[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+Client MAC key[20]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 |..XR |
+Server MAC key[20]:
+| 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 c3 0e b3 70 |lw.R..}.&.>....p|
+| e5 46 9c ad |.F.. |
+Client Write key[16]:
+| 76 59 4a db 1b 2b e4 45 d0 86 fd 28 55 ad d2 ef |vYJ..+.E...(U...|
+Server Write key[16]:
+| 8a d6 e1 30 cf 8c 7d 18 8e e5 18 af 12 f3 28 0c |...0..}.......(.|
+Client Write IV[16]:
+| f1 72 ce a8 76 d8 69 98 a8 8e 90 31 a0 66 f8 20 |.r..v.i....1.f. |
+Server Write IV[16]:
+| 65 f9 fd 52 17 25 05 79 b3 d3 55 21 7f f3 55 37 |e..R.%.y..U!..U7|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #398 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d567...
+looking for RSA pre-master0080aeb905c19d1a09d1a50bad095bdafcc02622d8b1e32e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.|
+| d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6|
+| ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;|
+| e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.|
+| 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.|
+| 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. |
+hash out[104]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..|
+| 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj|
+| 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..|
+| 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O|
+| da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..|
+| df 08 69 d9 fd 21 06 71 |..i..!.q |
+PRF out[104]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..|
+| 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj|
+| 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..|
+| 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O|
+| da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..|
+| df 08 69 d9 fd 21 06 71 |..i..!.q |
+key expansion[104]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..|
+| 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj|
+| 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..|
+| 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O|
+| da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..|
+| df 08 69 d9 fd 21 06 71 |..i..!.q |
+Client MAC key[20]:
+| 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...|
+| aa 7a 1a ea |.z.. |
+Server MAC key[20]:
+| dc 0b f6 11 1b 86 86 08 43 61 e6 db 6c a1 17 65 |........Ca..l..e|
+| 11 6e bb c7 |.n.. |
+Client Write key[16]:
+| 60 4d 62 2a c8 27 4b 6a 2f 48 26 e4 82 97 6a d2 |`Mb*.'Kj/H&...j.|
+Server Write key[16]:
+| 77 42 b2 35 d9 31 c5 f5 51 48 9c 96 59 75 76 c1 |wB.5.1..QH..Yuv.|
+Client Write IV[16]:
+| c9 bf c0 9c dd 7d 00 4f da 16 d1 c1 48 ae 2a af |.....}.O....H.*.|
+Server Write IV[16]:
+| 05 f7 aa 04 32 39 1e 1d df 08 69 d9 fd 21 06 71 |....29....i..!.q|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.|
+| d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6|
+| ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c6 1e 9c 56 50 69 56 72 5e 3b 82 31 0d 3b 39 f1 |...VPiVr^;.1.;9.|
+| ca d5 67 f2 fb 5f d4 cb 76 ea d7 6a c9 0a 26 19 |..g.._..v..j..&.|
+| a9 a7 55 54 41 0a a2 75 34 23 13 54 d1 f6 fd 34 |..UTA..u4#.T...4|
+| 17 9a f9 1f 18 3c 79 42 d0 dc a5 c6 07 b8 1c f6 |.....<yB........|
+Plaintext[64]:
+| bd 46 69 de 0b 31 61 91 2c bb 02 f1 3e 76 4f 13 |.Fi..1a.,...>vO.|
+| 14 00 00 0c 6a 08 e7 c2 d8 18 bf b1 2f 46 54 91 |....j......./FT.|
+| e6 00 f8 1c 63 3b 15 ce 94 4d 7d db e5 84 fc 94 |....c;...M}.....|
+| 2e 19 b6 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...5............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e6 00 f8 1c 63 3b 15 ce 94 4d 7d db e5 84 fc 94 |....c;...M}.....|
+| 2e 19 b6 35 |...5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #399 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| db 8f 6b 7a 27 d9 c3 8e 82 97 d7 1c a0 53 c4 93 |..kz'........S..|
+| ab 65 d1 0a d4 b0 18 ec b3 a8 29 73 95 8e a4 27 |.e........)s...'|
+| e2 ca c1 cc 11 ce 21 3e 09 0b da 12 ee ab 52 de |......!>......R.|
+| c0 66 a6 ba bd fa c4 7d ab e5 a3 01 1e 89 a8 32 |.f.....}.......2|
+Plaintext[64]:
+| a4 7b 6a aa 61 e2 de 95 a4 8f 57 ee 74 36 51 15 |.{j.a.....W.t6Q.|
+| 14 00 00 0c 51 f8 fb d8 09 36 0a ff 22 d1 66 cc |....Q....6..".f.|
+| a8 27 e2 7d 44 1a f7 7d 76 d8 f2 56 b9 4d 76 ed |.'.}D..}v..V.Mv.|
+| 6c 47 8c fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |lG..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a8 27 e2 7d 44 1a f7 7d 76 d8 f2 56 b9 4d 76 ed |.'.}D..}v..V.Mv.|
+| 6c 47 8c fc |lG.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #400 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| ac 3d 05 be 3e 73 a8 b2 60 8e 5e 6c bd 6e 54 23 |.=..>s..`.^l.nT#|
+| c1 99 78 88 ba 42 16 ef 19 42 5b 67 12 bc 39 58 |..x..B...B[g..9X|
+| 00 c9 6c 50 91 1a fc c7 7f 89 4d 05 89 fd 75 e4 |..lP......M...u.|
+| 1e 58 e2 d3 59 4b 94 9c 26 31 8c 84 d3 79 00 f3 |.X..YK..&1...y..|
+| c3 6a af ae 5f cf 60 9a ae ef cb 7f ed 0c 36 8c |.j.._.`.......6.|
+| f0 c6 30 0f e0 ea 66 4a da 06 6c d9 cf f1 8f 5c |..0...fJ..l....\|
+| 55 d7 4f 56 c0 79 ab 14 60 74 ba 7f 8d 33 7e 3b |U.OV.y..`t...3~;|
+Plaintext[112]:
+| 2b c4 90 ec 35 7a 40 8c 4f cd 7b 99 6a b4 b7 46 |+...5z@.O.{.j..F|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 73 65 |Host: dhe-rsa-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 32 0d 0a 0d 0a 31 aa d4 9e ff 86 aa cb a2 02 |72....1.........|
+| 1f 3c 06 b0 26 6f 7d e6 a9 95 05 05 05 05 05 05 |.<..&o}.........|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b1 97 61 f8 c9 3a ea f4 b2 66 f3 ca 33 dc 29 44 |..a..:...f..3.)D|
+| 87 53 fd d9 |.S.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34652 found (nil)
+association_find: TCP port 4472 found 0x33ce060
+
+dissect_ssl enter frame #401 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d6 5e 96 de 32 3d 96 55 34 7e bc 61 09 c3 41 7d |.^..2=.U4~.a..A}|
+| 52 55 1b e0 3e 29 f2 26 f3 d8 99 e2 92 83 c1 7b |RU..>).&.......{|
+| 7b 66 a4 f9 d2 1b 05 69 da 79 fc ac 89 ae 75 e3 |{f.....i.y....u.|
+| f1 a0 e8 8c 8c e9 a7 2f dd ed 8e 32 22 0b df ea |......./...2"...|
+| d9 30 aa 2a 18 a7 20 7a c1 0c 6a 9c 2e 1d 45 01 |.0.*.. z..j...E.|
+| 59 38 94 d2 84 29 31 8e 9a b3 2d 00 83 cd f6 39 |Y8...)1...-....9|
+| fb 08 26 87 ab 35 c7 1d 1a df 9e bc 1f 5b dd 41 |..&..5.......[.A|
+| 21 62 e8 94 d3 10 99 78 e7 2a c8 d0 1c 00 a2 1d |!b.....x.*......|
+| c4 d1 5f a8 3e af 98 fc 82 a2 62 8b 00 56 97 65 |.._.>.....b..V.e|
+| ed 38 2e 9f 33 cf 2a 19 40 94 1e 28 5b e2 66 d9 |.8..3.*.@..([.f.|
+| 15 c9 f1 65 78 27 ba f3 68 44 8e af da f3 b1 66 |...ex'..hD.....f|
+| f0 34 be 14 f2 df 86 bd a2 58 3d f7 9a 95 48 62 |.4.......X=...Hb|
+| 24 8e 16 4d ca 4d 98 db d9 92 61 a5 a3 35 bf 2c |$..M.M....a..5.,|
+| af 9a 36 1c fd da 7a 30 49 09 7a f1 e2 c8 fd 43 |..6...z0I.z....C|
+| d5 1d 01 98 ee c6 8e 2d bd 9c 15 27 11 a6 e4 4f |.......-...'...O|
+| 6f 3e a3 63 83 46 2b d2 f0 23 21 fb 05 71 a5 8f |o>.c.F+..#!..q..|
+| 54 ef 26 19 49 a9 4b 46 88 12 27 91 41 0b e1 f5 |T.&.I.KF..'.A...|
+| 48 43 f2 8b d4 dd 39 08 bf 68 3d 3f 90 1c 4c aa |HC....9..h=?..L.|
+| 0e e4 bb 6a 74 02 e0 22 2c 99 25 5f be a1 a6 1e |...jt..",.%_....|
+| de ab 66 b3 32 63 7f 6f bb 3b bf db c8 71 74 e3 |..f.2c.o.;...qt.|
+| 70 30 d6 17 d5 1e ab bf 6b ea 85 be 3d a3 1e 1b |p0......k...=...|
+| df fa e3 d9 16 0d dc 7e 9f 90 19 b0 da c3 33 1c |.......~......3.|
+| be c4 63 29 f2 8e f9 ab 32 b7 72 78 ae 1d aa 00 |..c)....2.rx....|
+| e9 f6 c4 b8 ed 5b 0f 9f fe 57 81 33 2e 6b 78 39 |.....[...W.3.kx9|
+| 99 46 97 1c 6d 9d c4 0b b6 2d 02 ac db 5a 51 8a |.F..m....-...ZQ.|
+Plaintext[400]:
+| 4f a3 84 9e 81 10 fb 5e 35 86 8b 98 1d e8 5c 2e |O......^5.....\.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R|
+| 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 75 d8 34 78 |nl'</script>u.4x|
+| c5 1f bb 12 9e af 9b cb 49 d3 43 c6 de 3a 02 8b |........I.C..:..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 97 45 05 4e 98 d6 1f 6b 78 d4 4a ad 94 e3 f8 c4 |.E.N...kx.J.....|
+| d4 f8 08 1d |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4472 found 0x33ce060
+
+dissect_ssl enter frame #402 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 92 19 19 b5 dc ab 59 18 e4 dc 2f c3 3f 66 76 bb |......Y.../.?fv.|
+| 4d 6d ab 0e 31 0b 1e e7 69 9e 73 e5 0e 95 93 79 |Mm..1...i.s....y|
+| a2 b2 57 d8 93 b0 28 0b 42 f0 31 05 29 4c 48 79 |..W...(.B.1.)LHy|
+Plaintext[48]:
+| 20 9f b0 76 a7 0d 9e a7 ad be c3 35 f7 21 08 9f | ..v.......5.!..|
+| 01 00 e3 d2 19 73 66 1a 3f 1e ca d7 7d 2a 51 c7 |.....sf.?...}*Q.|
+| 2f 28 c8 0f 53 ba 09 09 09 09 09 09 09 09 09 09 |/(..S...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 d2 19 73 66 1a 3f 1e ca d7 7d 2a 51 c7 2f 28 |...sf.?...}*Q./(|
+| c8 0f 53 ba |..S. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #404 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2f 4c 6a a7 3c d8 02 04 18 81 7c 7c f5 e1 c8 59 |/Lj.<.....||...Y|
+| ed 7c c9 ab d2 82 29 9a f9 e5 bb 3a d7 d0 00 68 |.|....)....:...h|
+| d4 02 d5 f9 05 b6 d7 ee 56 c5 03 0d 09 47 a8 40 |........V....G.@|
+Plaintext[48]:
+| a0 ad a1 9a 91 87 b3 e1 af b7 56 0d 19 b6 d9 31 |..........V....1|
+| 01 00 09 27 fb e5 72 af e4 bf c1 bc ff 11 80 cb |...'..r.........|
+| 28 64 72 8a 63 9a 09 09 09 09 09 09 09 09 09 09 |(dr.c...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 09 27 fb e5 72 af e4 bf c1 bc ff 11 80 cb 28 64 |.'..r.........(d|
+| 72 8a 63 9a |r.c. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #409 (first time)
+ssl_session_init: initializing ptr 0x7facc384e4b0 size 688
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34183 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4479
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #411 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC002 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.|
+| d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6|
+| ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 28 0c 4e 7b 0e 4e 70 ca 6f 36 b8 b1 fe c0 6d |%(.N{.Np.o6....m|
+| ac 16 f7 77 60 aa 7c 9e 8a 15 ab e5 f5 52 34 bf |...w`.|......R4.|
+| 25 06 e0 8e a2 a0 d6 d2 58 17 2d ce 2e 54 0d a6 |%.......X.-..T..|
+| c3 c6 40 1c af f3 d7 c4 6d 2b f4 26 51 |..@.....m+.&Q |
+hash out[72]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.|
+| e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y|
+| 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.|
+| 95 40 f7 29 f8 38 e2 21 |.@.).8.! |
+PRF out[72]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.|
+| e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y|
+| 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.|
+| 95 40 f7 29 f8 38 e2 21 |.@.).8.! |
+key expansion[72]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.|
+| e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y|
+| 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.|
+| 95 40 f7 29 f8 38 e2 21 |.@.).8.! |
+Client MAC key[20]:
+| 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.|
+| bf 38 b1 21 |.8.! |
+Server MAC key[20]:
+| 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 e5 e6 cb cc |*.........}.....|
+| 9f 18 43 92 |..C. |
+Client Write key[16]:
+| cd a0 f6 6a b0 af 87 79 2a a3 ef 6f f4 3c 5d 65 |...j...y*..o.<]e|
+Server Write key[16]:
+| 3f c3 eb 52 d6 c2 4d 1a 95 40 f7 29 f8 38 e2 21 |?..R..M..@.).8.!|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #413 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 154
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caf...
+looking for RSA pre-master6104408dff00e6a69e942bbca1848c290b3173ca6a797944...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b|
+| 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.|
+| e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 28 0c 4e 7b 0e 4e 70 ca 6f 36 b8 b1 fe c0 6d |%(.N{.Np.o6....m|
+| ac 16 f7 77 60 aa 7c 9e 8a 15 ab e5 f5 52 34 bf |...w`.|......R4.|
+| 25 06 e0 8e a2 a0 d6 d2 58 17 2d ce 2e 54 0d a6 |%.......X.-..T..|
+| c3 c6 40 1c af f3 d7 c4 6d 2b f4 26 51 |..@.....m+.&Q |
+hash out[72]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C|
+| ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.|
+| 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..|
+| ec 5f 1d d8 0e d6 ec 11 |._...... |
+PRF out[72]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C|
+| ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.|
+| 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..|
+| ec 5f 1d d8 0e d6 ec 11 |._...... |
+key expansion[72]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C|
+| ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.|
+| 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..|
+| ec 5f 1d d8 0e d6 ec 11 |._...... |
+Client MAC key[20]:
+| f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3|
+| 6e e0 b0 13 |n... |
+Server MAC key[20]:
+| 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 ae 80 93 ee |h2..5.....3C....|
+| bf e0 f6 e1 |.... |
+Client Write key[16]:
+| bb ef de 91 9c bf 46 fa 82 2c 88 0a c4 86 e7 44 |......F..,.....D|
+Server Write key[16]:
+| 47 0d af 08 c7 77 13 b6 ec 5f 1d d8 0e d6 ec 11 |G....w..._......|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 bd 73 03 00 00 00 00 |@.s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b|
+| 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.|
+| e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| b2 ea 4b a9 c3 7a ae 92 00 3a c0 4e e8 0c 5e 87 |..K..z...:.N..^.|
+| 6c 1c f0 4d 9c 6c 07 9a dd c8 a9 c5 5a 62 06 81 |l..M.l......Zb..|
+| b4 b9 93 b9 |.... |
+Plaintext[36]:
+| 14 00 00 0c 75 5f fb 5f 7d 83 4e b3 99 6a 0d 6c |....u_._}.N..j.l|
+| ce b7 bf 51 2e 45 65 9a ef bb a1 d0 41 11 0e 3a |...Q.Ee.....A..:|
+| 87 b9 3f f9 |..?. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ce b7 bf 51 2e 45 65 9a ef bb a1 d0 41 11 0e 3a |...Q.Ee.....A..:|
+| 87 b9 3f f9 |..?. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #414 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| e3 0e 63 dc 28 8a ef 67 d2 56 17 8f 2e f8 e4 3c |..c.(..g.V.....<|
+| 1b 65 76 d4 1a 06 bb d0 1a 4a d4 7a b2 42 25 fc |.ev......J.z.B%.|
+| 49 20 b2 82 |I .. |
+Plaintext[36]:
+| 14 00 00 0c cb ad 8d 7a fd c5 52 dd ea 0d 5d f3 |.......z..R...].|
+| 30 21 6c 30 41 33 94 32 87 4f db db 77 4b 7c 25 |0!l0A3.2.O..wK|%|
+| 54 ed bb 0d |T... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 30 21 6c 30 41 33 94 32 87 4f db db 77 4b 7c 25 |0!l0A3.2.O..wK|%|
+| 54 ed bb 0d |T... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #415 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 97
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 92, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 92
+Ciphertext[92]:
+| 37 81 57 36 d9 41 a4 b7 a7 40 e3 ba eb b3 b4 57 |7.W6.A...@.....W|
+| 25 df 83 6e c0 72 67 6b 34 a7 cc 5c 33 e9 0d 07 |%..n.rgk4..\3...|
+| 10 d3 a2 43 10 96 6a c7 b7 9a 1c b8 2d 46 90 51 |...C..j.....-F.Q|
+| 82 29 71 dd 6f 7f c1 42 22 99 d7 c6 ca dd 40 78 |.)q.o..B".....@x|
+| 8f d8 9b fe d2 f1 2a e6 92 bb c4 c4 fe 81 6b 2e |......*.......k.|
+| de 70 6b 8f f3 df c1 36 5a 03 92 c2 |.pk....6Z... |
+Plaintext[92]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a 6c 7d 56 2f 88 41 10 14 |4479....l}V/.A..|
+| 2d ba 2a ca b1 a4 80 06 0d 5b 2a 7f |-.*......[*. |
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 7d 56 2f 88 41 10 14 2d ba 2a ca b1 a4 80 06 |l}V/.A..-.*.....|
+| 0d 5b 2a 7f |.[*. |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72
+association_find: TCP port 34183 found (nil)
+association_find: TCP port 4479 found 0x3430b70
+dissect_ssl3_record decrypted len 72
+decrypted app data fragment[72]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 37 39 0d 0a 0d 0a |4479.... |
+dissect_ssl3_record found association 0x3430b70
+
+dissect_ssl enter frame #416 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 375
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 370, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 370
+Ciphertext[370]:
+| 81 3a 61 c1 4d ce c0 99 59 75 42 ae 68 a8 02 5e |.:a.M...YuB.h..^|
+| 70 23 65 b0 85 19 11 d8 85 70 14 6b e5 1b 8b 38 |p#e......p.k...8|
+| 23 f4 29 af ac 5d 90 9d 99 2c 01 5e d5 b1 96 4d |#.)..]...,.^...M|
+| 4c b2 99 8e bb 39 22 30 10 28 d2 37 95 25 04 c1 |L....9"0.(.7.%..|
+| 44 08 73 60 5e 23 6c 63 b7 63 79 73 c2 0c c1 d4 |D.s`^#lc.cys....|
+| 39 03 04 4e a4 cc de fe 3e 57 f6 1b 67 a9 f1 31 |9..N....>W..g..1|
+| 9f b6 2a 59 e7 0e 76 4a 96 f9 55 c5 32 fe ca cc |..*Y..vJ..U.2...|
+| 2b 44 81 42 14 85 27 e4 a1 80 c4 55 7c 4d ab 1f |+D.B..'....U|M..|
+| af 62 f0 0b f3 28 c9 8d b0 d4 18 8c 41 b5 a3 dd |.b...(......A...|
+| a1 ff fc 9d bb 52 d5 4c f6 73 be ce e7 3a 3d 98 |.....R.L.s...:=.|
+| 0e c0 85 de 8a e7 13 5c c0 c2 7a 41 a8 06 f6 b8 |.......\..zA....|
+| 36 73 f7 34 e6 62 d1 a7 15 a9 5f fb 89 4c 0d af |6s.4.b...._..L..|
+| 06 b5 46 61 91 f6 c9 ff b4 49 65 23 8f a3 6e e0 |..Fa.....Ie#..n.|
+| bd 11 3d 4a 6e 85 66 b7 ed 51 95 10 e5 a7 15 f1 |..=Jn.f..Q......|
+| 8f 59 33 98 4e 6d 42 6d 1e 7c 9a 9c 1c 63 22 03 |.Y3.NmBm.|...c".|
+| 52 03 8f b1 4f 63 42 41 dc 83 f5 ef 41 e8 13 f8 |R...OcBA....A...|
+| 60 e2 8e 57 9a f9 b3 7c ac c0 a0 cb 36 2a 31 c2 |`..W...|....6*1.|
+| 69 c8 c0 cc 03 6c 99 14 2a ea e0 df de d9 5d 7a |i....l..*.....]z|
+| 3d 09 9e 03 12 01 5f a3 09 47 ea f2 a7 47 cf 66 |=....._..G...G.f|
+| 67 d3 8d 58 9a 0e 77 c1 44 b6 a4 c8 be a5 48 aa |g..X..w.D.....H.|
+| 97 a5 11 bd e8 a7 f3 b2 bb 45 6a fb 31 ef c1 72 |.........Ej.1..r|
+| 0a f6 49 6c 98 28 ff 3d 4e 18 fe 28 0f cb a5 0c |..Il.(.=N..(....|
+| 34 12 e1 2f 85 7a 06 2a 76 72 26 2b b1 56 b0 07 |4../.z.*vr&+.V..|
+| dc 86 |.. |
+Plaintext[370]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 55 18 |n.nl'</script>U.|
+| c9 e6 ac 3e ed 25 b1 26 2c 85 68 32 3d 0b b9 43 |...>.%.&,.h2=..C|
+| 60 37 |`7 |
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 55 18 c9 e6 ac 3e ed 25 b1 26 2c 85 68 32 3d 0b |U....>.%.&,.h2=.|
+| b9 43 60 37 |.C`7 |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350
+association_find: TCP port 4479 found 0x3430b70
+dissect_ssl3_record decrypted len 350
+decrypted app data fragment[350]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-|
+| 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |n.nl'</script> |
+dissect_ssl3_record found association 0x3430b70
+
+dissect_ssl enter frame #417 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 7b d8 92 2e 47 f6 95 a9 07 9e 5a 34 82 65 30 d8 |{...G.....Z4.e0.|
+| a8 c8 4c 6b ef 8b |..Lk.. |
+Plaintext[22]:
+| 01 00 bd b1 03 9f ac 7b d8 db dd 33 37 ff 25 e0 |.......{...37.%.|
+| 96 79 09 29 30 2b |.y.)0+ |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bd b1 03 9f ac 7b d8 db dd 33 37 ff 25 e0 96 79 |.....{...37.%..y|
+| 09 29 30 2b |.)0+ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #419 (first time)
+ conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 73 e9 7d 8b 80 b8 88 71 be 58 08 f4 17 e3 26 f9 |s.}....q.X....&.|
+| cf a8 41 f6 66 31 |..A.f1 |
+Plaintext[22]:
+| 01 00 a4 3a bf 4b de d8 f9 4a 82 44 37 1e 99 01 |...:.K...J.D7...|
+| 0e 80 bf db 8d 06 |...... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 3a bf 4b de d8 f9 4a 82 44 37 1e 99 01 0e 80 |.:.K...J.D7.....|
+| bf db 8d 06 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #424 (first time)
+ssl_session_init: initializing ptr 0x7facc3850da0 size 688
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45570 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4480
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #426 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b|
+| 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.|
+| e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 13 8e 82 a2 1f 8e 47 09 de fd e3 48 1d ea c7 |%......G....H...|
+| 39 9e 4b 1b 80 b6 24 a5 c5 5f ab 33 e5 52 34 bf |9.K...$.._.3.R4.|
+| 25 02 42 88 2d 3c 8f 20 bc 8f 3e b6 3f 84 29 ad |%.B.-<. ..>.?.).|
+| 4e ef a1 78 53 30 d2 77 dd 09 12 98 12 |N..xS0.w..... |
+hash out[104]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.|
+| 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9|
+| 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.|
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.|
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+PRF out[104]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.|
+| 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9|
+| 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.|
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.|
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+key expansion[104]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.|
+| 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9|
+| 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.|
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.|
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+Client MAC key[20]:
+| 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...|
+| 96 89 b0 a6 |.... |
+Server MAC key[20]:
+| 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 89 5a 32 c4 |.8>.M....[+..Z2.|
+| 45 2b f8 d0 |E+.. |
+Client Write key[24]:
+| fc 8c 74 33 5a ba 40 39 3b 7b e6 95 50 2e b7 ae |..t3Z.@9;{..P...|
+| 6b 89 da 67 05 3d 6a 8d |k..g.=j. |
+Server Write key[24]:
+| a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._|
+| 96 e4 c2 46 4e 55 42 a3 |...FNUB. |
+Client Write IV[8]:
+| f0 ff 5f b7 1c ba 4f e5 |.._...O. |
+Server Write IV[8]:
+| bb 78 4c ec 08 f8 e7 d6 |.xL..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #428 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 166
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa17853...
+looking for RSA pre-master6104bc9ef092887a313a5a0b59d6b695eef1f38fdb5c55d0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.|
+| b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....|
+| 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 13 8e 82 a2 1f 8e 47 09 de fd e3 48 1d ea c7 |%......G....H...|
+| 39 9e 4b 1b 80 b6 24 a5 c5 5f ab 33 e5 52 34 bf |9.K...$.._.3.R4.|
+| 25 02 42 88 2d 3c 8f 20 bc 8f 3e b6 3f 84 29 ad |%.B.-<. ..>.?.).|
+| 4e ef a1 78 53 30 d2 77 dd 09 12 98 12 |N..xS0.w..... |
+hash out[104]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3|
+| 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...|
+| b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.|
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4|
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+PRF out[104]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3|
+| 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...|
+| b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.|
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4|
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+key expansion[104]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3|
+| 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...|
+| b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.|
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4|
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+Client MAC key[20]:
+| 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q|
+| 4e 48 31 7e |NH1~ |
+Server MAC key[20]:
+| 27 16 68 6c 9c 81 1c c6 7f 27 87 33 71 f4 fe ab |'.hl.....'.3q...|
+| f2 38 3b 0d |.8;. |
+Client Write key[24]:
+| a0 e3 ee 6f 35 9f f6 13 b1 f0 b7 66 af 01 23 b4 |...o5......f..#.|
+| 02 66 59 6c b6 ff 77 b7 |.fYl..w. |
+Server Write key[24]:
+| 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......|
+| 34 22 8a 44 56 cd d8 f3 |4".DV... |
+Client Write IV[8]:
+| 7c 64 0c b4 ef c5 c8 34 ||d.....4 |
+Server Write IV[8]:
+| a8 76 0b c5 fe 92 fb 29 |.v.....) |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.|
+| b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....|
+| 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 70 03 37 a1 d3 fd cb dd 99 3f 92 07 04 26 4d 15 |p.7......?...&M.|
+| ef fa 4d 65 62 e0 68 f8 10 45 99 f9 ad e2 4a f4 |..Meb.h..E....J.|
+| 4f e1 cd 9a 6e eb e3 e1 fe 87 3a 55 25 eb 8e f9 |O...n.....:U%...|
+Plaintext[48]:
+| ee 13 49 7c da a6 78 49 14 00 00 0c 67 df ec 09 |..I|..xI....g...|
+| 81 93 13 cb dc 73 a4 98 b8 cc e7 0e a2 f0 46 2b |.....s........F+|
+| c8 3b fc 5c 64 64 0b 61 91 4d b1 ce 03 03 03 03 |.;.\dd.a.M......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b8 cc e7 0e a2 f0 46 2b c8 3b fc 5c 64 64 0b 61 |......F+.;.\dd.a|
+| 91 4d b1 ce |.M.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #429 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d3 f8 94 13 8a 90 79 08 62 84 1f f5 43 12 48 6c |......y.b...C.Hl|
+| da 41 be 03 cc ce 13 33 d7 43 b8 c3 9d 9e 41 63 |.A.....3.C....Ac|
+| f5 d4 ed e1 74 36 69 52 fd df 3f 94 b3 99 79 6c |....t6iR..?...yl|
+Plaintext[48]:
+| 4b 03 56 8f 95 06 11 54 14 00 00 0c 0b 0b 6f a9 |K.V....T......o.|
+| e5 fa e5 21 51 a7 ff 42 a4 2c 9c 8d 4b bc 62 f5 |...!Q..B.,..K.b.|
+| e0 a2 c9 21 a7 3c 2e 0b 6f 70 63 f4 03 03 03 03 |...!.<..opc.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 2c 9c 8d 4b bc 62 f5 e0 a2 c9 21 a7 3c 2e 0b |.,..K.b....!.<..|
+| 6f 70 63 f4 |opc. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #430 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| af a2 41 f7 0e 1c e9 3f 48 81 26 37 5f cb 3c c8 |..A....?H.&7_.<.|
+| 20 2a bd 3c c0 ba 22 00 37 a3 dd a6 dc d0 8e 09 | *.<..".7.......|
+| 03 cf d0 12 d6 d3 ad b1 01 09 cc 86 69 3c 50 af |............i<P.|
+| f2 4c 4b 81 54 fb 3f 76 74 af a5 9a 7e d5 8c c8 |.LK.T.?vt...~...|
+| 35 73 85 34 e0 80 95 a3 85 d2 75 6d 74 5e 4e 9d |5s.4......umt^N.|
+| 0f a1 79 8c 59 0c 9d c2 54 d3 68 72 57 87 8e 56 |..y.Y...T.hrW..V|
+| 99 25 7d a8 47 02 ae 16 20 0a 02 e8 22 02 25 3a |.%}.G... ...".%:|
+Plaintext[112]:
+| 35 af a0 74 26 37 be d3 47 45 54 20 2f 20 48 54 |5..t&7..GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 63 |dh-ecdsa-des-cbc|
+| 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |3-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 38 |ekensteyn.nl:448|
+| 30 0d 0a 0d 0a 1f 1b bd 79 b9 e6 82 6b 89 1b e2 |0.......y...k...|
+| b6 12 ad 62 aa ce e0 d7 27 06 06 06 06 06 06 06 |...b....'.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 00 8a 55 6f d9 a6 bf 0f 8c 71 2c d0 b2 53 3e 54 |..Uo.....q,..S>T|
+| 67 38 db 4a |g8.J |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45570 found (nil)
+association_find: TCP port 4480 found 0x3430c00
+
+dissect_ssl enter frame #431 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 50 de b3 20 d9 ea 40 54 6e cf 50 fb 4e fd e8 21 |P.. ..@Tn.P.N..!|
+| 47 ec 5c 0a 0c a9 d3 53 34 3f f7 6f b1 56 aa ec |G.\....S4?.o.V..|
+| e5 75 c4 c7 25 3a de 33 6e fa 1d 3d 5f b6 a6 c1 |.u..%:.3n..=_...|
+| 11 18 c1 6f eb 16 66 e0 26 a3 7a 59 ed 64 80 af |...o..f.&.zY.d..|
+| d4 55 1b 1e c2 0f 12 33 79 87 06 61 f2 ba 81 f2 |.U.....3y..a....|
+| c8 6a 86 32 0d 2a 46 54 d2 ff a1 c4 e8 52 d7 7d |.j.2.*FT.....R.}|
+| 19 a3 be a9 87 fd a8 60 e3 8d e0 26 b8 ff f4 af |.......`...&....|
+| 0f cf 02 52 2a b8 f8 00 63 14 84 39 6a 59 66 54 |...R*...c..9jYfT|
+| d8 31 36 7c 71 d8 37 0d 45 21 c8 5e 23 11 01 71 |.16|q.7.E!.^#..q|
+| 00 f8 68 49 a8 27 fa 60 a0 d7 02 f2 b6 d5 19 27 |..hI.'.`.......'|
+| fd e4 12 d0 2b 81 c1 18 91 7c 54 9f 78 84 e3 5b |....+....|T.x..[|
+| ea e2 6f d2 03 09 97 6a 27 ec 7c 76 a0 0a 8e 4f |..o....j'.|v...O|
+| 9f 4c 51 2f d4 fc 7e 44 48 42 3f cb 7d fb b0 dd |.LQ/..~DHB?.}...|
+| 2c bf 1e 9b 92 d6 57 ec 5d 07 fe 0b 4f 60 b4 21 |,.....W.]...O`.!|
+| 01 0b c5 a7 e8 83 af 4f 7a c3 e8 9e 70 4f a9 7b |.......Oz...pO.{|
+| cb 66 b2 eb 47 82 5c fb d9 51 d0 f5 c8 09 b7 31 |.f..G.\..Q.....1|
+| 58 3a e9 f7 0c 7b 07 63 52 43 f2 0d d1 cf 5a c7 |X:...{.cRC....Z.|
+| 04 bc c1 56 fa cf 1a e6 58 11 68 2f 65 63 23 54 |...V....X.h/ec#T|
+| dd 8d 80 1e 12 b1 c0 a4 1f 8e e7 1e 0f d9 dc 35 |...............5|
+| a1 0d 67 7d 6b d7 9e 0d 69 22 86 80 1f 41 4d 72 |..g}k...i"...AMr|
+| cc 57 e4 ab a0 88 56 38 a1 cf 78 07 5c c0 f8 e5 |.W....V8..x.\...|
+| 5a 54 7b 0c 9e 1b 92 1b b7 2c 78 a3 99 92 32 af |ZT{......,x...2.|
+| 78 6d 66 43 5b b3 98 dd 56 ec 5a 04 6c fb f0 12 |xmfC[...V.Z.l...|
+| 51 e9 06 8d 26 3d ad b6 36 f4 24 be ec 69 a4 3b |Q...&=..6.$..i.;|
+Plaintext[384]:
+| ec 69 d2 96 bc 0a 7b 78 48 54 54 50 2f 31 2e 31 |.i....{xHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 37 20 47 4d |2013 19:55:17 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 33 |che....0xC0,0x03|
+| 20 2d 20 45 43 44 48 2d 45 43 44 53 41 2d 44 45 | - ECDH-ECDSA-DE|
+| 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 33 |S-CBC3-SHA SSLv3|
+| 20 4b 78 3d 45 43 44 48 2f 45 43 44 53 41 20 41 | Kx=ECDH/ECDSA A|
+| 75 3d 45 43 44 48 20 45 6e 63 3d 33 44 45 53 28 |u=ECDH Enc=3DES(|
+| 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1<sc|
+| 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f |ript>document.do|
+| 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'</s|
+| 63 72 69 70 74 3e 72 35 bf b7 c1 e8 79 87 4b 31 |cript>r5....y.K1|
+| 16 96 1b 8c 35 a9 4e 75 1e 4e 05 05 05 05 05 05 |....5.Nu.N......|
+ssl_decrypt_record found padding 5 final len 378
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 20 53 25 f4 70 8d b9 45 c8 ab 3f 81 0b 85 d7 78 | S%.p..E..?....x|
+| 12 d7 4e 1e |..N. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4480 found 0x3430c00
+
+dissect_ssl enter frame #432 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 05 0f 19 82 1e 06 0a 85 ae 7a c2 b1 84 40 80 6d |.........z...@.m|
+| 32 57 f5 2a 32 54 e0 c2 39 bc ae 60 2e e8 27 44 |2W.*2T..9..`..'D|
+Plaintext[32]:
+| c0 e4 fb 91 41 0e 85 c4 01 00 35 51 58 60 f3 04 |....A.....5QX`..|
+| 37 94 6a 0a 20 38 cc 21 15 7c 5f 15 9b bf 01 01 |7.j. 8.!.|_.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 35 51 58 60 f3 04 37 94 6a 0a 20 38 cc 21 15 7c |5QX`..7.j. 8.!.||
+| 5f 15 9b bf |_... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #434 (first time)
+ conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2e 13 8b 64 1d b9 64 51 86 e9 dc 9e f5 19 c5 3f |...d..dQ.......?|
+| b1 a6 1d 8b 59 d0 70 17 30 7b a0 d9 8b 1a 43 e4 |....Y.p.0{....C.|
+Plaintext[32]:
+| ce 1a c6 03 0a 75 f5 3b 01 00 05 c2 40 e6 8f fe |.....u.;....@...|
+| 6b 3c ec d2 dd 32 25 13 66 76 03 ce 95 2e 01 01 |k<...2%.fv......|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 05 c2 40 e6 8f fe 6b 3c ec d2 dd 32 25 13 66 76 |..@...k<...2%.fv|
+| 03 ce 95 2e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #439 (first time)
+ssl_session_init: initializing ptr 0x7facc38532c0 size 688
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35291 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4481
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #441 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.|
+| b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....|
+| 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 50 c5 36 e6 fa 6b 21 55 2a 9c d9 4d f3 ae 7e |%P.6..k!U*..M..~|
+| 26 f1 9e 79 f3 a9 8d 35 44 2f 37 3b 6f 52 34 bf |&..y...5D/7;oR4.|
+| 25 d3 23 f9 f2 b3 94 e3 a7 ca 28 a0 8a 38 32 e4 |%.#.......(..82.|
+| b5 c1 cd ba 6b 86 7f 53 c5 69 65 67 00 |....k..S.ieg. |
+hash out[104]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.|
+| 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%|
+| b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8|
+| ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..|
+| e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.|
+| 5f 4d 6b 97 01 04 b6 e2 |_Mk..... |
+PRF out[104]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.|
+| 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%|
+| b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8|
+| ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..|
+| e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.|
+| 5f 4d 6b 97 01 04 b6 e2 |_Mk..... |
+key expansion[104]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.|
+| 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%|
+| b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8|
+| ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..|
+| e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.|
+| 5f 4d 6b 97 01 04 b6 e2 |_Mk..... |
+Client MAC key[20]:
+| 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j|
+| 0f 6a 64 b9 |.jd. |
+Server MAC key[20]:
+| 76 82 96 de 82 80 4c bc 58 9d 24 c4 76 fe b7 6e |v.....L.X.$.v..n|
+| db 4c ef 9a |.L.. |
+Client Write key[16]:
+| 70 0a 0a 63 22 70 fe 25 b9 ec 73 1e c5 2e 38 be |p..c"p.%..s...8.|
+Server Write key[16]:
+| 71 7e 61 ee 8a 6f 52 38 ff ab f2 cd 46 f5 ba 07 |q~a..oR8....F...|
+Client Write IV[16]:
+| 57 78 9e 14 e8 53 92 bf e9 1f 6d af e2 3b 49 cf |Wx...S....m..;I.|
+Server Write IV[16]:
+| 68 8b 18 23 a1 1b 44 14 5f 4d 6b 97 01 04 b6 e2 |h..#..D._Mk.....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #443 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b...
+looking for RSA pre-master61049253a2d836006b56eb0fce73adc57dd6f0dc24475d45...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh|
+| 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.|
+| d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 50 c5 36 e6 fa 6b 21 55 2a 9c d9 4d f3 ae 7e |%P.6..k!U*..M..~|
+| 26 f1 9e 79 f3 a9 8d 35 44 2f 37 3b 6f 52 34 bf |&..y...5D/7;oR4.|
+| 25 d3 23 f9 f2 b3 94 e3 a7 ca 28 a0 8a 38 32 e4 |%.#.......(..82.|
+| b5 c1 cd ba 6b 86 7f 53 c5 69 65 67 00 |....k..S.ieg. |
+hash out[104]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....|
+| a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8|
+| 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......|
+| b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...|
+| 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x|
+| 09 1b c7 2c bd c8 dc 40 |...,...@ |
+PRF out[104]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....|
+| a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8|
+| 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......|
+| b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...|
+| 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x|
+| 09 1b c7 2c bd c8 dc 40 |...,...@ |
+key expansion[104]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....|
+| a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8|
+| 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......|
+| b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...|
+| 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x|
+| 09 1b c7 2c bd c8 dc 40 |...,...@ |
+Client MAC key[20]:
+| 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............|
+| d8 66 92 05 |.f.. |
+Server MAC key[20]:
+| f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f a0 ea 41 cc |....X-z.......A.|
+| aa c4 7a 33 |..z3 |
+Client Write key[16]:
+| d0 a5 84 15 60 02 50 38 85 d9 f3 4c 48 c1 21 84 |....`.P8...LH.!.|
+Server Write key[16]:
+| f4 6a a0 86 da 96 f2 ea b3 3f 39 01 15 6c 98 31 |.j.......?9..l.1|
+Client Write IV[16]:
+| 0f 9f 24 69 29 0f fe 92 81 53 31 ee 8f b3 c6 ec |..$i)....S1.....|
+Server Write IV[16]:
+| f9 2e c5 f2 5c a9 1e 78 09 1b c7 2c bd c8 dc 40 |....\..x...,...@|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh|
+| 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.|
+| d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 75 bf 62 a4 f8 a3 56 b2 46 e3 4f 33 64 24 6c 14 |u.b...V.F.O3d$l.|
+| 0a 6d 35 c1 bf a3 af a7 74 f3 b3 30 d6 44 86 c4 |.m5.....t..0.D..|
+| c9 21 93 e7 81 4d ee 21 14 d4 1a 9d 9a 73 ea cc |.!...M.!.....s..|
+| d4 eb d6 9b 5c 25 1e 70 14 41 c9 fe 41 56 8d cd |....\%.p.A..AV..|
+Plaintext[64]:
+| 06 2e 78 f0 0f 9d 30 40 95 7d cc a9 0a 24 ee ae |..x...0@.}...$..|
+| 14 00 00 0c fd bf 9a cb 14 b6 e4 fa 41 e7 ce 8e |............A...|
+| 75 af 2e 7d 2e 1e 64 13 d2 03 d8 74 42 17 76 33 |u..}..d....tB.v3|
+| 19 52 ae 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 75 af 2e 7d 2e 1e 64 13 d2 03 d8 74 42 17 76 33 |u..}..d....tB.v3|
+| 19 52 ae 9d |.R.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #444 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fe a7 fb fd 27 b4 e6 f9 fe 9f d0 10 00 ef b4 c9 |....'...........|
+| bf 56 37 a3 85 c9 3a 52 36 d8 d0 18 34 62 78 4b |.V7...:R6...4bxK|
+| f4 c1 8b 32 e0 c0 d0 c5 e9 0f 67 d6 d5 f0 95 87 |...2......g.....|
+| f3 43 29 31 aa 22 06 8c 33 a6 3f 9a 8e 78 c6 6b |.C)1."..3.?..x.k|
+Plaintext[64]:
+| 96 05 18 ca 7c 2a cc 08 9e e0 eb 25 34 bd d3 27 |....|*.....%4..'|
+| 14 00 00 0c 0c 5a 41 2b ca 34 b9 ed 46 c0 b2 59 |.....ZA+.4..F..Y|
+| 45 e8 72 39 3c 95 06 b1 2d 09 70 84 ad c6 4e 00 |E.r9<...-.p...N.|
+| 7a ec 1b bd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |z...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 45 e8 72 39 3c 95 06 b1 2d 09 70 84 ad c6 4e 00 |E.r9<...-.p...N.|
+| 7a ec 1b bd |z... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #445 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| eb ea bb c5 42 22 1b cc e7 8f 02 91 b7 9b aa 29 |....B".........)|
+| 72 26 8b b2 5d c7 ab 4d cb 58 3d 50 59 83 87 71 |r&..]..M.X=PY..q|
+| b9 f6 f6 61 85 b0 e7 10 c0 70 96 2d 8f 02 4c c4 |...a.....p.-..L.|
+| 38 a5 7e 09 91 2c e2 1d 35 5f b6 51 02 34 bf 0d |8.~..,..5_.Q.4..|
+| 19 d4 48 be 21 b2 ec 63 d2 45 13 62 f8 b0 2f 7e |..H.!..c.E.b../~|
+| 4e bc 75 1d 7b d5 5d 9c 90 2d 8c 1b 6b 74 d5 d7 |N.u.{.]..-..kt..|
+| a5 b5 d0 08 aa 8a 6c cd ce 61 65 b7 63 25 1a d4 |......l..ae.c%..|
+Plaintext[112]:
+| a8 f9 c1 d6 91 b9 6b be 1e 3b c3 72 7e 8d 03 d3 |......k..;.r~...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 31 0d 0a 0d 0a f7 ba 44 d4 94 |nl:4481......D..|
+| f7 4c 3d ce 63 a9 8b 65 06 78 34 5c 9a 32 71 00 |.L=.c..e.x4\.2q.|
+ssl_decrypt_record found padding 0 final len 111
+checking mac (len 75, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bd a5 61 5a 0a 32 d0 5d 92 e2 aa 5f 2a 84 f7 80 |..aZ.2.]..._*...|
+| 69 ba 6d bd |i.m. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35291 found (nil)
+association_find: TCP port 4481 found 0x3430c90
+
+dissect_ssl enter frame #446 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 51 29 df f3 28 35 9a 91 4e 9a b6 35 a4 86 b9 1f |Q)..(5..N..5....|
+| 31 74 b8 7e 01 31 87 37 bb 07 ec 56 34 a6 d9 c0 |1t.~.1.7...V4...|
+| ad b8 7e 05 f9 fb d5 93 30 de 14 a1 45 3a 1c db |..~.....0...E:..|
+| ce bd 04 be 98 32 c7 4f 3b 36 10 54 54 5a 8b 91 |.....2.O;6.TTZ..|
+| a3 f7 5e 68 1a bd 1e fb 27 f5 ad 59 14 99 8c b0 |..^h....'..Y....|
+| 60 0c 74 2e bc b6 63 02 c2 3e 9a 76 7f 69 c8 9c |`.t...c..>.v.i..|
+| 8c 08 e4 1e 98 6e bc 8d 8a fc fa f6 08 0c d2 93 |.....n..........|
+| 79 e6 62 e4 cb af 18 2f 75 25 b8 11 3e 31 ec ed |y.b..../u%..>1..|
+| 94 aa b8 d0 d4 78 6f 24 7b 5d 10 1b 9b 3c c2 da |.....xo${]...<..|
+| 58 31 f9 8c fb 56 a6 ea 7e 3c 6a 53 8d ff 0f b0 |X1...V..~<jS....|
+| 0b ce 7d 31 6b 77 45 2e ea a8 83 51 54 08 c9 72 |..}1kwE....QT..r|
+| af 6d b6 0a 92 12 e3 cb 77 13 f1 a9 56 99 39 2e |.m......w...V.9.|
+| 2b 2e c8 13 5f 28 b4 3b 5e 8d 00 49 32 a4 f3 99 |+..._(.;^..I2...|
+| cf 3a d0 98 cb c2 a7 1e 9a db a9 ba 0c 00 e8 fc |.:..............|
+| 04 28 e2 36 2a 61 99 31 41 74 3c e6 cc 1e ef 7c |.(.6*a.1At<....||
+| 2c 2f c0 1c d9 96 17 c1 86 69 17 33 41 64 33 2a |,/.......i.3Ad3*|
+| 39 b2 0b 72 ae a7 e4 e0 f4 e0 3f e6 55 fb 21 3c |9..r......?.U.!<|
+| f6 98 ed ba 1f 7b b6 a6 8c 6e 85 2f ad 44 1b 3a |.....{...n./.D.:|
+| 60 01 ec 1f 9b 40 47 3f 6e 70 7b 07 21 e6 f5 75 |`....@G?np{.!..u|
+| ad 3d 9e e1 bd ca f4 30 84 8a 75 86 9b 0f 93 55 |.=.....0..u....U|
+| ab ad 03 51 1e 9c ee 94 43 d8 58 34 a7 c3 ec 0d |...Q....C.X4....|
+| f0 da ea 6e eb ea 20 8d 67 ac d0 fb 16 ac 35 1a |...n.. .g.....5.|
+| 4b 10 96 77 b7 33 3e 2a 0a cd 13 0a 6b 5e 7c 40 |K..w.3>*....k^|@|
+| 1d 10 73 9e ff c1 7d 8f 2e 35 85 7e 93 5c ce 76 |..s...}..5.~.\.v|
+| 19 03 83 42 a7 88 d4 18 68 1d e0 42 dc be d1 b1 |...B....h..B....|
+Plaintext[400]:
+| bd 10 31 61 37 d4 69 67 18 e6 b7 96 37 2a 27 2a |..1a7.ig....7*'*|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 1b c7 |n.nl'</script>..|
+| e1 5d 38 8b c0 38 96 65 e2 af 6b 8c a3 fb 93 c9 |.]8..8.e..k.....|
+| b7 d7 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |................|
+ssl_decrypt_record found padding 13 final len 386
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 1a bb 57 65 99 ca b4 9e ef 5e 89 9f 2a fb 4b |...We.....^..*.K|
+| 26 8c 25 cf |&.%. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4481 found 0x3430c90
+
+dissect_ssl enter frame #447 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b4 f5 18 d0 43 34 fe c7 c7 3f 87 73 7d 64 92 bc |....C4...?.s}d..|
+| 29 a7 d0 ed fd c8 57 54 e2 99 35 74 67 14 f6 b8 |).....WT..5tg...|
+| a1 b0 c2 83 d6 73 9e ae a7 6c 43 41 78 7d aa c7 |.....s...lCAx}..|
+Plaintext[48]:
+| 79 19 51 7f 84 21 f3 17 eb b8 6f f2 fd ef 09 78 |y.Q..!....o....x|
+| 01 00 0e 5b 36 82 40 dc be 1a 15 e1 67 c3 8b 5d |...[6.@.....g..]|
+| c8 d9 49 dc 64 ed 09 09 09 09 09 09 09 09 09 09 |..I.d...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0e 5b 36 82 40 dc be 1a 15 e1 67 c3 8b 5d c8 d9 |.[6.@.....g..]..|
+| 49 dc 64 ed |I.d. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #449 (first time)
+ conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 91 73 4c b2 33 cb e3 ce c5 56 23 76 f1 56 64 a7 |.sL.3....V#v.Vd.|
+| be f6 34 62 8d 10 41 26 86 a8 61 b9 26 56 33 4d |..4b..A&..a.&V3M|
+| e9 a1 f3 6a d1 e2 30 5e e2 71 d0 02 10 29 e7 51 |...j..0^.q...).Q|
+Plaintext[48]:
+| 18 c7 bd 0c 40 79 14 42 fa b6 c2 2b 19 8f 95 75 |....@y.B...+...u|
+| 01 00 f8 6a 60 84 77 c4 38 3e 49 38 d0 5d 82 3e |...j`.w.8>I8.].>|
+| 68 ac f2 86 f9 c4 09 09 09 09 09 09 09 09 09 09 |h...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f8 6a 60 84 77 c4 38 3e 49 38 d0 5d 82 3e 68 ac |.j`.w.8>I8.].>h.|
+| f2 86 f9 c4 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #454 (first time)
+ssl_session_init: initializing ptr 0x7facc38557a0 size 688
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60875 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4482
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #456 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 565
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh|
+| 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.|
+| d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 80 8d ed eb bd 3b d0 5b 31 a2 1d 90 f8 a9 2a |%.....;.[1.....*|
+| 66 61 5f 19 52 fa e6 5b d0 65 fd 0a 9f 52 34 bf |fa_.R..[.e...R4.|
+| 25 dd 94 8c 65 1c 8c f3 3a 31 16 2b b4 23 86 31 |%...e...:1.+.#.1|
+| 08 c3 77 f8 e9 56 1e b5 3d c5 d5 35 c4 |..w..V..=..5. |
+hash out[136]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v|
+| 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.|
+| f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....|
+| 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..|
+| 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L|
+| c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..|
+| 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..|
+| 11 1e bb 07 67 2b c0 8b |....g+.. |
+PRF out[136]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v|
+| 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.|
+| f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....|
+| 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..|
+| 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L|
+| c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..|
+| 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..|
+| 11 1e bb 07 67 2b c0 8b |....g+.. |
+key expansion[136]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v|
+| 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.|
+| f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....|
+| 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..|
+| 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L|
+| c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..|
+| 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..|
+| 11 1e bb 07 67 2b c0 8b |....g+.. |
+Client MAC key[20]:
+| 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A|
+| 2c 4e d1 9b |,N.. |
+Server MAC key[20]:
+| 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 93 05 ad f7 |W...4.)....v....|
+| 14 85 14 12 |.... |
+Client Write key[32]:
+| 5a 11 f6 20 3f 6f 4a ce f9 78 07 82 ad f0 1e 12 |Z.. ?oJ..x......|
+| 7d 02 40 44 0e fd 16 b6 07 ae 76 68 8a 19 da 50 |}.@D......vh...P|
+Server Write key[32]:
+| 02 8f 8d 2c fb 6f 07 e8 5f 99 5e c1 8c 62 72 4f |...,.o.._.^..brO|
+| 83 cc 33 93 4b b9 89 4c c1 15 1e 38 4b aa 23 cd |..3.K..L...8K.#.|
+Client Write IV[16]:
+| 7e 18 d1 f6 d1 30 81 2e 41 6d f8 a9 4d 50 fd 05 |~....0..Am..MP..|
+Server Write IV[16]:
+| d4 70 40 54 21 2b be b6 11 1e bb 07 67 2b c0 8b |.p@T!+......g+..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 494
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565
+
+dissect_ssl enter frame #458 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 182
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 102, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9...
+looking for RSA pre-master61040104fe730d1a5fed30a8d6f3f23fa1cc83517c116595...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-|
+| aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.|
+| 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. |
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 80 8d ed eb bd 3b d0 5b 31 a2 1d 90 f8 a9 2a |%.....;.[1.....*|
+| 66 61 5f 19 52 fa e6 5b d0 65 fd 0a 9f 52 34 bf |fa_.R..[.e...R4.|
+| 25 dd 94 8c 65 1c 8c f3 3a 31 16 2b b4 23 86 31 |%...e...:1.+.#.1|
+| 08 c3 77 f8 e9 56 1e b5 3d c5 d5 35 c4 |..w..V..=..5. |
+hash out[136]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..|
+| b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...|
+| 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....n<f.......5|
+| f4 66 01 96 a8 7c b5 4b 89 51 c3 44 71 1d b7 f3 |.f...|.K.Q.Dq...|
+| 86 dd d8 ad 48 c8 d2 df 4e a1 77 91 36 55 63 1f |....H...N.w.6Uc.|
+| da 3c e4 d0 85 59 97 5d ef 8d b7 bf cf 2f 6d a2 |.<...Y.]...../m.|
+| 67 cf d0 e1 0b a9 26 ca 99 51 b4 6d fe ed 91 24 |g.....&..Q.m...$|
+| b3 13 c1 55 6b 1b 41 e3 |...Uk.A. |
+PRF out[136]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..|
+| b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...|
+| 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....n<f.......5|
+| f4 66 01 96 a8 7c b5 4b 89 51 c3 44 71 1d b7 f3 |.f...|.K.Q.Dq...|
+| 86 dd d8 ad 48 c8 d2 df 4e a1 77 91 36 55 63 1f |....H...N.w.6Uc.|
+| da 3c e4 d0 85 59 97 5d ef 8d b7 bf cf 2f 6d a2 |.<...Y.]...../m.|
+| 67 cf d0 e1 0b a9 26 ca 99 51 b4 6d fe ed 91 24 |g.....&..Q.m...$|
+| b3 13 c1 55 6b 1b 41 e3 |...Uk.A. |
+key expansion[136]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..|
+| b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...|
+| 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....n<f.......5|
+| f4 66 01 96 a8 7c b5 4b 89 51 c3 44 71 1d b7 f3 |.f...|.K.Q.Dq...|
+| 86 dd d8 ad 48 c8 d2 df 4e a1 77 91 36 55 63 1f |....H...N.w.6Uc.|
+| da 3c e4 d0 85 59 97 5d ef 8d b7 bf cf 2f 6d a2 |.<...Y.]...../m.|
+| 67 cf d0 e1 0b a9 26 ca 99 51 b4 6d fe ed 91 24 |g.....&..Q.m...$|
+| b3 13 c1 55 6b 1b 41 e3 |...Uk.A. |
+Client MAC key[20]:
+| fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s|
+| a1 02 55 0b |..U. |
+Server MAC key[20]:
+| 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 b6 22 25 d4 |.........,..."%.|
+| 60 8d e5 fc |`... |
+Client Write key[32]:
+| 97 38 49 5f 2f d1 9b 02 02 11 91 0c 14 6e 3c 66 |.8I_/........n<f|
+| cf aa a7 1d 85 d3 cf 35 f4 66 01 96 a8 7c b5 4b |.......5.f...|.K|
+Server Write key[32]:
+| 89 51 c3 44 71 1d b7 f3 86 dd d8 ad 48 c8 d2 df |.Q.Dq.......H...|
+| 4e a1 77 91 36 55 63 1f da 3c e4 d0 85 59 97 5d |N.w.6Uc..<...Y.]|
+Client Write IV[16]:
+| ef 8d b7 bf cf 2f 6d a2 67 cf d0 e1 0b a9 26 ca |...../m.g.....&.|
+Server Write IV[16]:
+| 99 51 b4 6d fe ed 91 24 b3 13 c1 55 6b 1b 41 e3 |.Q.m...$...Uk.A.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-|
+| aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.|
+| 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. |
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 107, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 113, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 08 2f be 9e 54 e4 0d 13 27 06 16 ca 33 74 19 66 |./..T...'...3t.f|
+| 08 3b 22 20 3f 07 03 45 f6 93 bb 67 61 37 cc 64 |.;" ?..E...ga7.d|
+| 94 ab cf f0 f1 14 2b 2e 3e 59 db 93 fb e6 4f 73 |......+.>Y....Os|
+| 15 0d b1 77 a1 23 4c 7e 1a b5 a1 6c 08 35 aa 7b |...w.#L~...l.5.{|
+Plaintext[64]:
+| 96 07 63 c8 08 b0 ca 4d 5f f3 8d 51 45 7a c4 80 |..c....M_..QEz..|
+| 14 00 00 0c 76 c0 c9 7f 9f 3e 1d ac 8b 12 f3 ad |....v....>......|
+| d8 52 55 fe 4e 30 ff d8 b9 ae 30 55 93 cb 01 6b |.RU.N0....0U...k|
+| 24 e3 eb f6 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |$...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d8 52 55 fe 4e 30 ff d8 b9 ae 30 55 93 cb 01 6b |.RU.N0....0U...k|
+| 24 e3 eb f6 |$... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #459 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 3b 02 8e 3c 38 7b 10 1e 56 20 c3 41 f7 53 ce 1a |;..<8{..V .A.S..|
+| 22 dd 49 2b 41 16 15 a6 dd 23 6b 19 ec f1 8a 97 |".I+A....#k.....|
+| 47 01 07 39 75 59 66 08 29 a5 a0 80 88 29 d1 a8 |G..9uYf.)....)..|
+| 14 9f b7 c5 8d c6 6d c4 c6 b3 06 e1 b5 c3 19 d7 |......m.........|
+Plaintext[64]:
+| db 1c 72 a8 c1 f7 b8 d5 b2 07 b7 62 c6 b6 67 f5 |..r........b..g.|
+| 14 00 00 0c 5b ef 6b 9d 33 f4 75 91 a0 45 9a 52 |....[.k.3.u..E.R|
+| ce 16 59 45 7a b3 77 78 07 69 b6 85 14 47 5d 48 |..YEz.wx.i...G]H|
+| 42 d2 ae 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |B...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ce 16 59 45 7a b3 77 78 07 69 b6 85 14 47 5d 48 |..YEz.wx.i...G]H|
+| 42 d2 ae 05 |B... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #460 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 6f ec f7 59 0d 5f 81 c6 b5 28 80 83 ba 82 4b ff |o..Y._...(....K.|
+| 3e 6a a8 24 23 3b b2 ee bd 37 a3 c5 69 42 22 f8 |>j.$#;...7..iB".|
+| c0 6d d5 cc 87 24 db fb 30 7a 00 89 55 c9 df 02 |.m...$..0z..U...|
+| 9f 56 52 08 e6 ed bd 42 71 86 2c da 00 f6 95 34 |.VR....Bq.,....4|
+| ec f7 3c f7 a4 f9 c5 26 f5 b6 ca 7d d4 dc f9 91 |..<....&...}....|
+| cf 3b 5a be 7c 4f dc 7b 3c 5a 30 90 87 22 4d d9 |.;Z.|O.{<Z0.."M.|
+| eb 8f 4f 51 bd 53 5a ce 0c ec cf 49 02 0e 31 5f |..OQ.SZ....I..1_|
+Plaintext[112]:
+| a8 e3 f7 a2 9d f2 51 46 12 e6 dd a4 ba cd 10 9b |......QF........|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa|
+| 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 3a 34 34 38 32 0d 0a 0d 0a eb b1 2e 4e 65 |nl:4482.......Ne|
+| ae f0 b9 44 30 7d 6a 6a 54 75 53 c9 bf b5 0f 00 |...D0}jjTuS.....|
+ssl_decrypt_record found padding 0 final len 111
+checking mac (len 75, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c5 99 98 b0 46 d1 27 b1 14 85 b5 28 59 da 6f 1c |....F.'....(Y.o.|
+| 60 1b 1a 8c |`... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60875 found (nil)
+association_find: TCP port 4482 found 0x3430d20
+
+dissect_ssl enter frame #461 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e9 7a c3 1d c1 aa 83 9a 22 4f ac ab 49 15 01 73 |.z......"O..I..s|
+| c5 90 cb 2c f7 bd 39 7d d7 29 1e b1 9e 7c c8 95 |...,..9}.)...|..|
+| ab 51 ec c1 0e b7 15 17 33 0c f8 d0 d1 84 d5 53 |.Q......3......S|
+| b6 5e 88 b8 07 4f 79 70 2c 07 3e 0a dc 3c c4 32 |.^...Oyp,.>..<.2|
+| a9 00 f6 b9 e2 86 cf 0d 42 39 7f fa 16 9a 3a 38 |........B9....:8|
+| 43 6e 3d 39 9c f9 88 c5 dd f1 b6 a7 56 6a 17 54 |Cn=9........Vj.T|
+| 50 ea c5 9b c8 79 7c 80 14 4e 46 21 6d 32 ad 84 |P....y|..NF!m2..|
+| 1a 5a 80 0f 9b d6 f7 90 a1 ff 93 1e 5a d5 1c 10 |.Z..........Z...|
+| 69 35 0a 23 67 8e d9 30 fb 86 3b b4 0a 71 f1 09 |i5.#g..0..;..q..|
+| 31 70 54 0f 28 bc 3d b3 29 bc ce 5a 4e 25 5f e9 |1pT.(.=.)..ZN%_.|
+| 02 e3 e2 fc 6f 3f 7e 55 3d 51 51 4e 18 7d 0f d5 |....o?~U=QQN.}..|
+| 43 51 e4 b8 be 97 9d be 9e dd 54 4e e6 d6 ad ab |CQ........TN....|
+| 82 96 5c a7 ca 9d 58 8a 75 e9 2d 34 87 73 93 f9 |..\...X.u.-4.s..|
+| 4d 5e f5 87 3b 8d 4a 77 92 7f 8a 91 38 63 e1 df |M^..;.Jw....8c..|
+| e2 dc 58 c9 55 47 5b 18 1f 5d 0a 71 f9 7d 63 2c |..X.UG[..].q.}c,|
+| ea 98 44 b3 fc a0 3a 8b 5e 3b 0e e3 7e 1c d4 7b |..D...:.^;..~..{|
+| a0 0f 3b 33 80 65 c1 f6 47 e1 64 fc 03 dd 3c 3f |..;3.e..G.d...<?|
+| 69 c9 e0 ca de 57 fd 30 93 30 4b 8b 13 5d 00 29 |i....W.0.0K..].)|
+| 61 91 3c 1b f2 1a 2c 9a 63 a0 44 65 79 35 0d 79 |a.<...,.c.Dey5.y|
+| a2 48 1a 4b b2 58 ab 9a d0 d2 16 be 0a 26 cd 54 |.H.K.X.......&.T|
+| 2a d7 c4 85 2a 22 7b 8f 00 85 2a d5 d0 0b 57 65 |*...*"{...*...We|
+| 09 cd 6c c7 03 61 e9 ce 08 73 f4 55 29 f1 1a 8a |..l..a...s.U)...|
+| d6 b4 e6 a8 62 bc d3 07 d5 fd 9c ed ac 4f 59 6e |....b........OYn|
+| e3 6e f8 1d 65 7a 65 8f 7b 68 ec 47 fb 29 40 7b |.n..eze.{h.G.)@{|
+| 40 7c f0 78 49 88 80 3a 79 6e 98 ba 26 4f 82 ab |@|.xI..:yn..&O..|
+Plaintext[400]:
+| 42 54 c9 4f 7e b5 16 c9 33 4d 14 3c 9f 71 6b 6d |BT.O~...3M.<.qkm|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-|
+| 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA|
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E|
+| 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac|
+| 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1<script>doc|
+| 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e c7 50 |n.nl'</script>.P|
+| 4f 0f 5d 32 96 72 59 0c 4a 96 c0 71 3e 0f a7 d5 |O.]2.rY.J..q>...|
+| 43 de 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |C...............|
+ssl_decrypt_record found padding 13 final len 386
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 03 16 0b 97 e0 f2 a8 38 51 1d f8 c8 2c 3c bf 6a |.......8Q...,<.j|
+| 8c 98 39 82 |..9. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4482 found 0x3430d20
+
+dissect_ssl enter frame #462 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 26 4b 3b 3b 40 da a9 bd a1 cc 9f fd 77 f8 65 9f |&K;;@.......w.e.|
+| 04 0e bf fe de 3c de 88 64 dc 1e 4f 73 b8 ca 21 |.....<..d..Os..!|
+| 03 62 21 37 1e f3 57 bb 05 e3 96 b5 c8 48 7a b3 |.b!7..W......Hz.|
+Plaintext[48]:
+| 9c bc 84 c1 65 72 ae 5c 32 75 23 89 82 51 c2 e8 |....er.\2u#..Q..|
+| 01 00 81 64 71 ae b5 b2 b9 41 08 0a 64 e3 1c 35 |...dq....A..d..5|
+| cb 76 01 3f b4 7b 09 09 09 09 09 09 09 09 09 09 |.v.?.{..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 81 64 71 ae b5 b2 b9 41 08 0a 64 e3 1c 35 cb 76 |.dq....A..d..5.v|
+| 01 3f b4 7b |.?.{ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #464 (first time)
+ conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 6a d1 a6 c4 76 79 0a 8d a3 9f af 8e a1 19 03 fb |j...vy..........|
+| 7c 8c ea aa ec e5 0e 34 7d 50 05 be 3d 25 c9 cc ||......4}P..=%..|
+| ba 01 0d 55 c8 8c 27 63 a5 e3 62 8d b5 51 87 94 |...U..'c..b..Q..|
+Plaintext[48]:
+| 92 71 31 33 22 30 f4 d8 1b c0 37 46 c9 89 53 ef |.q13"0....7F..S.|
+| 01 00 dd 34 a5 a3 bd 69 e8 61 84 cb 09 20 b2 68 |...4...i.a... .h|
+| 6d 95 ba 01 56 05 09 09 09 09 09 09 09 09 09 09 |m...V...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| dd 34 a5 a3 bd 69 e8 61 84 cb 09 20 b2 68 6d 95 |.4...i.a... .hm.|
+| ba 01 56 05 |..V. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #469 (first time)
+ssl_session_init: initializing ptr 0x7facc3857c80 size 688
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 42810 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4483
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #471 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 751
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-|
+| aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.|
+| 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. |
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 be cb 55 c6 ba dc 80 91 52 b9 ad 79 ee 35 c3 |%..U.....R..y.5.|
+| c4 b2 ff 61 cb c0 9a 02 5d 1b 12 45 53 52 34 bf |...a....]..ESR4.|
+| 25 36 41 17 b6 4e 6c d3 32 95 37 71 73 08 7b 12 |%6A..Nl.2.7qs.{.|
+| dc f7 b8 17 99 d0 88 12 3c bc c2 77 46 |........<..wF |
+hash out[72]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..|
+| 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".<r..C..FN#.I|
+| 52 53 83 5e ed e4 4b c9 57 e7 d6 5a 32 b9 23 61 |RS.^..K.W..Z2.#a|
+| 86 21 85 61 c9 57 6c bf |.!.a.Wl. |
+PRF out[72]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..|
+| 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".<r..C..FN#.I|
+| 52 53 83 5e ed e4 4b c9 57 e7 d6 5a 32 b9 23 61 |RS.^..K.W..Z2.#a|
+| 86 21 85 61 c9 57 6c bf |.!.a.Wl. |
+key expansion[72]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..|
+| 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".<r..C..FN#.I|
+| 52 53 83 5e ed e4 4b c9 57 e7 d6 5a 32 b9 23 61 |RS.^..K.W..Z2.#a|
+| 86 21 85 61 c9 57 6c bf |.!.a.Wl. |
+Client MAC key[20]:
+| 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........|
+| 07 70 ab b9 |.p.. |
+Server MAC key[20]:
+| 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c 51 2b 22 a4 |...|3....`..Q+".|
+| 3c 72 eb fa |<r.. |
+Client Write key[16]:
+| 43 ec cd 46 4e 23 94 49 52 53 83 5e ed e4 4b c9 |C..FN#.IRS.^..K.|
+Server Write key[16]:
+| 57 e7 d6 5a 32 b9 23 61 86 21 85 61 c9 57 6c bf |W..Z2.#a.!.a.Wl.|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 680
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 195
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 181, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 177 bytes, remaining 742
+ record: offset = 742, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 747 length 0 bytes, remaining 751
+
+dissect_ssl enter frame #473 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799...
+looking for RSA pre-master4104a377ae79f26777c1ba7ff8da9b95ddd0b7306727cf0e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...|
+| 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...|
+| 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 25 be cb 55 c6 ba dc 80 91 52 b9 ad 79 ee 35 c3 |%..U.....R..y.5.|
+| c4 b2 ff 61 cb c0 9a 02 5d 1b 12 45 53 52 34 bf |...a....]..ESR4.|
+| 25 36 41 17 b6 4e 6c d3 32 95 37 71 73 08 7b 12 |%6A..Nl.2.7qs.{.|
+| dc f7 b8 17 99 d0 88 12 3c bc c2 77 46 |........<..wF |
+hash out[72]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 |..J.a.Mr|e...T0.|
+| c6 62 1f 08 e0 a3 dd 93 25 47 47 00 82 d4 82 e1 |.b......%GG.....|
+| 4d 86 60 77 ee 4b d0 cf 95 64 bf 27 3c 56 80 4d |M.`w.K...d.'<V.M|
+| 86 07 f3 18 da 2b 42 85 |.....+B. |
+PRF out[72]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 |..J.a.Mr|e...T0.|
+| c6 62 1f 08 e0 a3 dd 93 25 47 47 00 82 d4 82 e1 |.b......%GG.....|
+| 4d 86 60 77 ee 4b d0 cf 95 64 bf 27 3c 56 80 4d |M.`w.K...d.'<V.M|
+| 86 07 f3 18 da 2b 42 85 |.....+B. |
+key expansion[72]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 |..J.a.Mr|e...T0.|
+| c6 62 1f 08 e0 a3 dd 93 25 47 47 00 82 d4 82 e1 |.b......%GG.....|
+| 4d 86 60 77 ee 4b d0 cf 95 64 bf 27 3c 56 80 4d |M.`w.K...d.'<V.M|
+| 86 07 f3 18 da 2b 42 85 |.....+B. |
+Client MAC key[20]:
+| e9 53 1d c9 f0 9b fb f0 81 3a 44 d4 2f 0b 86 98 |.S.......:D./...|
+| fb ed 4a ca |..J. |
+Server MAC key[20]:
+| 61 09 4d 72 7c 65 c6 a1 e4 54 30 12 c6 62 1f 08 |a.Mr|e...T0..b..|
+| e0 a3 dd 93 |.... |
+Client Write key[16]:
+| 25 47 47 00 82 d4 82 e1 4d 86 60 77 ee 4b d0 cf |%GG.....M.`w.K..|
+Server Write key[16]:
+| 95 64 bf 27 3c 56 80 4d 86 07 f3 18 da 2b 42 85 |.d.'<V.M.....+B.|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 80 be 73 03 00 00 00 00 |..s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...|
+| 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...|
+| 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| ce aa 82 b5 53 3b 88 d8 d7 16 e9 50 71 a6 fa 33 |....S;.....Pq..3|
+| 05 06 6b df 6f 21 11 0f aa d6 ed 3e 68 e7 9e f8 |..k.o!.....>h...|
+| d1 a0 74 82 |..t. |
+Plaintext[36]:
+| 14 00 00 0c ee 62 f1 67 47 d3 1d da cf 2c 7d 1c |.....b.gG....,}.|
+| 3f c2 a4 ec 7a 1b b5 16 3e 0c 6f ca 18 cc 60 cd |?...z...>.o...`.|
+| 11 fa 61 d8 |..a. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3f c2 a4 ec 7a 1b b5 16 3e 0c 6f ca 18 cc 60 cd |?...z...>.o...`.|
+| 11 fa 61 d8 |..a. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #474 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| ba 97 7a 31 c8 e9 66 87 80 47 3a ab 1b 9f 70 89 |..z1..f..G:...p.|
+| 31 e8 64 10 0d d4 e8 4d 82 87 45 16 58 c0 b0 9c |1.d....M..E.X...|
+| 4a 3e 52 fa |J>R. |
+Plaintext[36]:
+| 14 00 00 0c e0 e7 60 19 fa 1f 79 0c c8 60 ab 81 |......`...y..`..|
+| 07 48 84 a6 eb c8 f8 4a 57 e1 16 c8 27 f0 88 fa |.H.....JW...'...|
+| b5 3f 9b 01 |.?.. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 07 48 84 a6 eb c8 f8 4a 57 e1 16 c8 27 f0 88 fa |.H.....JW...'...|
+| b5 3f 9b 01 |.?.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #475 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 98
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 93, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 93
+Ciphertext[93]:
+| d4 c9 e6 1e 68 aa a0 94 f4 bc 84 fd a7 95 7b 3b |....h.........{;|
+| 02 b1 7a bf 65 57 a5 31 d1 e1 e9 6c 37 da 0a c4 |..z.eW.1...l7...|
+| 08 c0 3a dd c1 d3 67 07 d5 8c 1b dd d7 06 d3 43 |..:...g........C|
+| ef 53 04 36 cc c1 1a 3b 28 a3 2a 3c 77 cd 48 d8 |.S.6...;(.*<w.H.|
+| 1d 5b fa 89 04 f8 f3 19 d8 d4 a6 b9 37 a5 72 da |.[..........7.r.|
+| bc 33 70 6a bc 93 b6 82 07 68 aa 25 d0 |.3pj.....h.%. |
+Plaintext[93]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a fb 6e 69 02 61 70 fb |:4483.....ni.ap.|
+| 45 f6 26 51 37 bc 92 db e4 a3 e4 a5 67 |E.&Q7.......g |
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fb 6e 69 02 61 70 fb 45 f6 26 51 37 bc 92 db e4 |.ni.ap.E.&Q7....|
+| a3 e4 a5 67 |...g |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73
+association_find: TCP port 42810 found (nil)
+association_find: TCP port 4483 found 0x3430db0
+dissect_ssl3_record decrypted len 73
+decrypted app data fragment[73]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 38 33 0d 0a 0d 0a |:4483.... |
+dissect_ssl3_record found association 0x3430db0
+
+dissect_ssl enter frame #476 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 374
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 369, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 369
+Ciphertext[369]:
+| 94 cc 95 cd a2 0b cc cd d9 44 c8 e8 b5 9d 3a 14 |.........D....:.|
+| 40 7c f6 79 7f 21 e8 4a 5b 81 73 01 8e 9a 84 7c |@|.y.!.J[.s....||
+| c9 19 24 86 f0 7e 4c 44 95 23 8f 2b ca c7 80 bf |..$..~LD.#.+....|
+| 97 b6 c5 fb 35 bd e0 71 e9 1d 8a a1 7c 2a 7d f2 |....5..q....|*}.|
+| 03 b9 41 aa b7 30 9d 62 db b7 ae eb 32 8c 20 35 |..A..0.b....2. 5|
+| 90 8d 84 4c 58 80 a3 76 80 18 f6 4d 6c 54 a7 d6 |...LX..v...MlT..|
+| 3c bd b7 f9 3b ee 19 4f 89 9d d9 90 d8 4c 61 40 |<...;..O.....La@|
+| a7 fb 74 01 df ff ec cd 4d 05 e1 5b 21 b4 73 b7 |..t.....M..[!.s.|
+| d0 7f 13 5a d2 73 27 03 c3 e5 34 bc 61 b8 e7 7c |...Z.s'...4.a..||
+| 16 61 a6 7f aa 82 2a bd fa 2d 0d 03 f4 33 33 70 |.a....*..-...33p|
+| 16 0d 60 96 1c b3 37 4f d3 f9 01 57 d5 a8 d1 a4 |..`...7O...W....|
+| e0 fd 8b 81 d9 57 49 c6 b0 73 e1 27 03 9b ef e9 |.....WI..s.'....|
+| d0 97 b9 07 79 1f e8 d3 b6 c7 7c 7b fa ad cc 87 |....y.....|{....|
+| 27 69 88 98 c0 35 6e c7 e3 e3 21 13 29 ee 63 3d |'i...5n...!.).c=|
+| f6 3a 42 ac c6 d7 04 82 4b 48 5b 0a f7 09 c5 19 |.:B.....KH[.....|
+| 17 5d 2b 0f b0 4d 2b 4f 6f fc 3b 43 44 89 76 02 |.]+..M+Oo.;CD.v.|
+| fe 34 d1 24 90 52 9f 7b 68 02 64 60 88 f6 e5 8d |.4.$.R.{h.d`....|
+| 5d ce 72 15 ab 7b b6 0a 26 5a 5a b9 94 cc 09 3d |].r..{..&ZZ....=|
+| fe 43 e7 bc d9 67 e9 80 d3 2b 89 65 fd db b4 b2 |.C...g...+.e....|
+| 12 ff fa ee 65 5a 0b 3a c4 27 55 28 1e 6a e1 cc |....eZ.:.'U(.j..|
+| 66 44 03 1f 4c 50 f7 ee 9c f3 7f 48 1e 09 c4 55 |fD..LP.....H...U|
+| 78 e8 0e 47 ed d2 8e 7f 1c f0 ea 7b 0a d1 02 0b |x..G.......{....|
+| f2 05 fa 0c 4d 5b 47 f8 f0 6c e1 01 4a 22 02 af |....M[G..l..J"..|
+| 14 |. |
+Plaintext[369]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 7d 92 d3 |.nl'</script>}..|
+| 03 69 9e 5b 68 86 cf e6 eb bd 43 f0 59 7d 08 33 |.i.[h.....C.Y}.3|
+| 3b |; |
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7d 92 d3 03 69 9e 5b 68 86 cf e6 eb bd 43 f0 59 |}...i.[h.....C.Y|
+| 7d 08 33 3b |}.3; |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349
+association_find: TCP port 4483 found 0x3430db0
+dissect_ssl3_record decrypted len 349
+decrypted app data fragment[349]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE|
+| 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |.nl'</script> |
+dissect_ssl3_record found association 0x3430db0
+
+dissect_ssl enter frame #477 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 91 eb 41 55 a6 69 2b b3 b8 d0 ab 4f b5 37 f4 cf |..AU.i+....O.7..|
+| 67 c0 18 15 f2 d7 |g..... |
+Plaintext[22]:
+| 01 00 b3 72 3d 19 41 db 4e 37 4b 91 75 e7 a7 d9 |...r=.A.N7K.u...|
+| 56 c8 92 fc 14 eb |V..... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 72 3d 19 41 db 4e 37 4b 91 75 e7 a7 d9 56 c8 |.r=.A.N7K.u...V.|
+| 92 fc 14 eb |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #479 (first time)
+ conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 17 04 df 10 8e cf b7 65 de 05 75 56 3a 9f 8c 4d |.......e..uV:..M|
+| b4 31 49 a5 bf 33 |.1I..3 |
+Plaintext[22]:
+| 01 00 75 37 2b d5 78 bc f0 9d f8 f5 2c 27 01 e3 |..u7+.x.....,'..|
+| 90 4c 2d ce d1 3c |.L-..< |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 75 37 2b d5 78 bc f0 9d f8 f5 2c 27 01 e3 90 4c |u7+.x.....,'...L|
+| 2d ce d1 3c |-..< |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #484 (first time)
+ssl_session_init: initializing ptr 0x7facc385a590 size 688
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 36532 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4484
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #486 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 749
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...|
+| 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...|
+| 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 63 75 18 a1 69 ea 50 83 57 47 1e b7 43 54 10 |&cu..i.P.WG..CT.|
+| 58 0c ac 52 59 b1 d9 6a 75 21 53 a1 90 52 34 bf |X..RY..ju!S..R4.|
+| 26 4e 71 d4 63 88 17 c3 e3 1b ea ef 04 7e fe 0b |&Nq.c........~..|
+| 65 a6 4c 7c f5 a8 7a b0 39 b4 09 0e 7a |e.L|..z.9...z |
+hash out[104]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......|
+| e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......|
+| 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!|
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..|
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+PRF out[104]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......|
+| e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......|
+| 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!|
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..|
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+key expansion[104]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......|
+| e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......|
+| 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!|
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..|
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+Client MAC key[20]:
+| 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*|
+| 21 2a 52 36 |!*R6 |
+Server MAC key[20]:
+| 27 51 df fd 26 07 ed 9a e8 84 a5 e3 e7 93 f5 c1 |'Q..&...........|
+| a8 e6 6d bd |..m. |
+Client Write key[24]:
+| 41 ff f5 14 86 0c 83 e0 4f 0c 8f 83 c7 ac ad d2 |A.......O.......|
+| a7 3a bb 09 da 06 16 21 |.:.....! |
+Server Write key[24]:
+| 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M|
+| cf e0 d6 d1 fa e0 39 52 |......9R |
+Client Write IV[8]:
+| ce a2 aa 3c ec 47 fa de |...<.G.. |
+Server Write IV[8]:
+| 4a c6 7e b0 e4 2d 68 dc |J.~..-h. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 678
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 193
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 179, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 175 bytes, remaining 740
+ record: offset = 740, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 745 length 0 bytes, remaining 749
+
+dissect_ssl enter frame #488 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5...
+looking for RSA pre-master41048d81014331c4904f5fb9f90ff4fb8410ee7d7640b337...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.|
+| 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..|
+| db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 63 75 18 a1 69 ea 50 83 57 47 1e b7 43 54 10 |&cu..i.P.WG..CT.|
+| 58 0c ac 52 59 b1 d9 6a 75 21 53 a1 90 52 34 bf |X..RY..ju!S..R4.|
+| 26 4e 71 d4 63 88 17 c3 e3 1b ea ef 04 7e fe 0b |&Nq.c........~..|
+| 65 a6 4c 7c f5 a8 7a b0 39 b4 09 0e 7a |e.L|..z.9...z |
+hash out[104]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c|
+| 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.|
+| ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.|
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........|
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+PRF out[104]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c|
+| 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.|
+| ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.|
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........|
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+key expansion[104]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c|
+| 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.|
+| ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.|
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........|
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+Client MAC key[20]:
+| cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^|
+| ef 49 27 42 |.I'B |
+Server MAC key[20]:
+| d9 c4 d7 39 99 61 e5 fe af 74 2e 63 6d 28 dc c8 |...9.a...t.cm(..|
+| c6 e7 2f a0 |../. |
+Client Write key[24]:
+| 66 54 12 d7 09 08 36 b8 ba b7 e8 7b b3 88 e5 8b |fT....6....{....|
+| 8d e3 4c 2c bf 71 5c 88 |..L,.q\. |
+Server Write key[24]:
+| 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~|
+| c9 ed 03 44 f9 5b e6 10 |...D.[.. |
+Client Write IV[8]:
+| 11 da ea a9 d6 e1 bb 0e |........ |
+Server Write IV[8]:
+| 32 09 fc eb 05 43 4c 35 |2....CL5 |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.|
+| 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..|
+| db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3d 5c 24 34 49 df 11 1f 88 f8 10 8d 0c 45 a5 85 |=\$4I........E..|
+| 81 b9 4c 0c d0 92 93 8b 48 7e 99 79 6b 97 85 e5 |..L.....H~.yk...|
+| e7 06 29 f4 93 43 18 cc a8 17 f6 ba 81 74 b4 e1 |..)..C.......t..|
+Plaintext[48]:
+| 6d f5 51 62 95 30 1e 66 14 00 00 0c bb 70 ed f7 |m.Qb.0.f.....p..|
+| 9c 48 f1 8c bc be 44 cd 25 95 cf e3 9d 53 c3 f1 |.H....D.%....S..|
+| b7 64 e1 da 31 60 a0 9e f7 12 5f 15 03 03 03 03 |.d..1`...._.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 95 cf e3 9d 53 c3 f1 b7 64 e1 da 31 60 a0 9e |%....S...d..1`..|
+| f7 12 5f 15 |.._. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #489 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 43 75 06 06 0c e5 61 8f e4 8a 5f 4e 2d a3 7d 00 |Cu....a..._N-.}.|
+| 6b 91 2e ee 8a ff 12 b4 97 99 26 f4 4d d1 f2 9d |k.........&.M...|
+| 66 82 b7 b6 9d a3 8e b8 11 ca c9 59 07 04 df 6e |f..........Y...n|
+Plaintext[48]:
+| ff de 57 1b 17 2e 9e 0f 14 00 00 0c 99 9d 64 0a |..W...........d.|
+| 48 ce 30 75 fb 26 7e d7 52 ce 51 aa bf 46 80 eb |H.0u.&~.R.Q..F..|
+| df 86 20 e0 ba b4 dd 5b 8f 48 c2 e8 03 03 03 03 |.. ....[.H......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 52 ce 51 aa bf 46 80 eb df 86 20 e0 ba b4 dd 5b |R.Q..F.... ....[|
+| 8f 48 c2 e8 |.H.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #490 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 1b 72 0f a2 1b 36 0a 91 7b e8 d7 a1 da c8 e7 ad |.r...6..{.......|
+| 23 c4 12 6f a6 4b 79 97 7c 4a ab 09 fe 7f 20 3d |#..o.Ky.|J.... =|
+| 98 af 7d 9d f6 43 b0 54 73 66 90 e2 51 7a 88 19 |..}..C.Tsf..Qz..|
+| a2 77 8f 09 a8 f2 47 97 cc 6a 42 cc d2 62 ae cf |.w....G..jB..b..|
+| 1e 64 d7 98 42 1f 19 25 91 90 b3 0d 36 06 2e 95 |.d..B..%....6...|
+| a5 8a 15 91 ff 21 2b b0 dd 96 68 d5 f0 ad 7b b1 |.....!+...h...{.|
+| f1 24 a2 59 ac a2 51 e4 8c 0f 34 ab 06 9f 23 9b |.$.Y..Q...4...#.|
+Plaintext[112]:
+| 59 6e f5 de 2b 6a 5e 58 47 45 54 20 2f 20 48 54 |Yn..+j^XGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 65 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 |dhe-ecdsa-des-cb|
+| 63 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |c3-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 38 34 0d 0a 0d 0a b7 ce 64 82 ec 01 38 20 f5 c5 |84......d...8 ..|
+| d0 ac 05 85 fb 66 c6 01 69 05 05 05 05 05 05 05 |.....f..i.......|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 78, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 1d 9c 0c af ee b0 17 71 c8 d9 42 c5 de d8 da 9c |.......q..B.....|
+| ba 10 6d 30 |..m0 |
+ssl_decrypt_record: mac failed
+association_find: TCP port 36532 found (nil)
+association_find: TCP port 4484 found 0x3430e40
+
+dissect_ssl enter frame #491 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 6d 94 19 90 42 6f 88 28 fa 85 6d 21 d1 f3 86 8a |m...Bo.(..m!....|
+| d6 fd e9 1a c8 e0 dc d0 df 46 06 27 49 cf 54 aa |.........F.'I.T.|
+| 2d 17 6e 00 db 2a 4f b4 74 9e fb 95 9b 26 34 f9 |-.n..*O.t....&4.|
+| 06 8d f6 0f 3f 5a bd 56 06 65 32 2b 64 89 6c fa |....?Z.V.e2+d.l.|
+| de e9 fa 35 e7 46 b7 f5 aa cd c9 b5 0a c5 40 c1 |...5.F........@.|
+| 16 33 47 90 c7 cd 37 e6 68 ca 6d 4f cc 1f 18 d0 |.3G...7.h.mO....|
+| 8b 33 48 a0 22 b4 92 3d 2e 83 d7 0b 25 e0 f3 28 |.3H."..=....%..(|
+| d8 33 b4 0c 9a 9f f6 42 23 73 5c 24 c1 54 d0 29 |.3.....B#s\$.T.)|
+| 83 26 4e 77 80 11 e6 b2 4a 05 32 08 68 4e 8a f8 |.&Nw....J.2.hN..|
+| ce 4d 89 1e 2e 91 84 2c cf f1 3e ae 4e 54 55 68 |.M.....,..>.NTUh|
+| 1b f0 2e c9 52 38 79 49 09 b6 6e 28 aa 69 29 05 |....R8yI..n(.i).|
+| 76 79 f1 99 72 d0 68 cf 07 0b 44 b5 62 fc ea 2f |vy..r.h...D.b../|
+| cc 2d 63 6d 5e 40 a9 de b4 40 bd 5a 21 7f 72 9a |.-cm^@...@.Z!.r.|
+| dc f3 a1 59 1f b5 49 f5 57 ce 59 ba 21 58 3c 35 |...Y..I.W.Y.!X<5|
+| a0 b8 85 c1 70 a5 29 8b dc 7e 4d 75 7a b9 21 67 |....p.)..~Muz.!g|
+| 86 0f 14 9c 48 62 3f 4f 53 91 8e 06 fa 92 b0 22 |....Hb?OS......"|
+| fd b1 37 2e 41 9d 0e 82 d3 a8 c3 46 7d 8c 46 40 |..7.A......F}.F@|
+| f7 cd a5 eb f4 02 c4 58 1c 73 12 e7 eb 76 bd 18 |.......X.s...v..|
+| 2c 8a 23 36 47 38 94 fd 43 88 3a 9c ca 46 28 bc |,.#6G8..C.:..F(.|
+| c5 11 38 dd e1 ae 73 15 a3 42 74 55 6e 27 0c aa |..8...s..BtUn'..|
+| 2d 51 4c 8d c9 f6 21 b5 42 71 a4 9a 8c 02 45 5d |-QL...!.Bq....E]|
+| 60 24 27 7c 73 c9 91 30 21 c2 db 28 db cc a3 2d |`$'|s..0!..(...-|
+| 1a b0 f1 8e 73 dd 20 fe cd 7e ea 3f 10 d2 f0 b7 |....s. ..~.?....|
+| 3b 72 3b 36 a1 25 be d7 2d bc 44 20 ca b9 0b d0 |;r;6.%..-.D ....|
+Plaintext[384]:
+| 6d f2 a3 0b 4f c4 20 03 48 54 54 50 2f 31 2e 31 |m...O. .HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 38 20 47 4d |2013 19:55:18 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 38 |che....0xC0,0x08|
+| 20 2d 20 45 43 44 48 45 2d 45 43 44 53 41 2d 44 | - ECDHE-ECDSA-D|
+| 45 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 |ES-CBC3-SHA SSLv|
+| 33 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 |3 Kx=ECDH Au|
+| 3d 45 43 44 53 41 20 45 6e 63 3d 33 44 45 53 28 |=ECDSA Enc=3DES(|
+| 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1<sc|
+| 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f |ript>document.do|
+| 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'</s|
+| 63 72 69 70 74 3e a8 df 1f d0 a1 a2 9a 50 74 23 |cript>.......Pt#|
+| 81 e8 8e fb af 96 08 a4 5f 21 05 05 05 05 05 05 |........_!......|
+ssl_decrypt_record found padding 5 final len 378
+checking mac (len 350, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4d c3 3e 6b cd b7 cd 8c 19 ad f8 6a f1 a8 cf d2 |M.>k.......j....|
+| 48 4f 77 04 |HOw. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4484 found 0x3430e40
+
+dissect_ssl enter frame #492 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 3e b9 b5 3b 53 b8 6f 54 a7 a1 36 2f 24 01 77 5d |>..;S.oT..6/$.w]|
+| 5b f0 43 e4 8b 64 cf 85 82 41 27 f9 b0 12 64 0c |[.C..d...A'...d.|
+Plaintext[32]:
+| 7c e1 7e ef 91 21 98 ed 01 00 fd 03 a8 5e 8e 9c ||.~..!.......^..|
+| 1d f3 0f b0 18 94 c3 db d5 07 29 fc dc 09 01 01 |..........).....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fd 03 a8 5e 8e 9c 1d f3 0f b0 18 94 c3 db d5 07 |...^............|
+| 29 fc dc 09 |)... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #494 (first time)
+ conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| c4 53 be c4 c4 03 1e 8c d4 fa 9a fa 70 f1 25 85 |.S..........p.%.|
+| 64 be b1 7e b1 c8 0d 02 8f 24 b2 9f 6f 6e 4f f1 |d..~.....$..onO.|
+Plaintext[32]:
+| 29 86 58 2a f2 ef 5d a1 01 00 27 c7 2b d9 6e ff |).X*..]...'.+.n.|
+| 81 21 3f f5 a6 6b 6f 13 45 f6 10 5e cd 36 01 01 |.!?..ko.E..^.6..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 27 c7 2b d9 6e ff 81 21 3f f5 a6 6b 6f 13 45 f6 |'.+.n..!?..ko.E.|
+| 10 5e cd 36 |.^.6 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #499 (first time)
+ssl_session_init: initializing ptr 0x7facc385ca50 size 688
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 39630 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4485
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #501 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 750
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.|
+| 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..|
+| db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 71 56 d7 fa 01 ff 15 62 7d 9b 9a ce 03 51 1c |&qV.....b}....Q.|
+| a7 df de 84 61 af f9 71 20 c4 fd d3 87 52 34 bf |....a..q ....R4.|
+| 26 77 b4 93 f8 e1 66 8f 05 35 c7 c5 61 25 77 1b |&w....f..5..a%w.|
+| 4a 55 b7 33 38 ea 0f f7 72 1a 67 e2 98 |JU.38...r.g.. |
+hash out[104]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........|
+| 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.|
+| 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..|
+| 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...|
+| 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...|
+| 26 c7 57 9e 42 9d 83 ef |&.W.B... |
+PRF out[104]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........|
+| 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.|
+| 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..|
+| 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...|
+| 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...|
+| 26 c7 57 9e 42 9d 83 ef |&.W.B... |
+key expansion[104]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........|
+| 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.|
+| 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..|
+| 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...|
+| 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...|
+| 26 c7 57 9e 42 9d 83 ef |&.W.B... |
+Client MAC key[20]:
+| 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..|
+| 70 0e f8 d8 |p... |
+Server MAC key[20]:
+| 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 3b 3e 90 da |_{..........;>..|
+| a0 28 68 bb |.(h. |
+Client Write key[16]:
+| 68 d0 95 37 99 0f 50 ed 75 c1 f5 07 50 4b fa 1b |h..7..P.u...PK..|
+Server Write key[16]:
+| e0 3b 62 1a 65 5b 9a e0 91 47 fd b6 2b c7 ab f4 |.;b.e[...G..+...|
+Client Write IV[16]:
+| b4 e8 d8 92 28 9d d8 f5 18 e0 7f 31 43 c1 20 4a |....(......1C. J|
+Server Write IV[16]:
+| bd 18 be 1d 6d 00 7f c9 26 c7 57 9e 42 9d 83 ef |....m...&.W.B...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 679
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 194
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 180, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741
+ record: offset = 741, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750
+
+dissect_ssl enter frame #503 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338...
+looking for RSA pre-master41045172346374c18ca3903255dc325746d328a62dbde1b4...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.|
+| 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k|
+| 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 71 56 d7 fa 01 ff 15 62 7d 9b 9a ce 03 51 1c |&qV.....b}....Q.|
+| a7 df de 84 61 af f9 71 20 c4 fd d3 87 52 34 bf |....a..q ....R4.|
+| 26 77 b4 93 f8 e1 66 8f 05 35 c7 c5 61 25 77 1b |&w....f..5..a%w.|
+| 4a 55 b7 33 38 ea 0f f7 72 1a 67 e2 98 |JU.38...r.g.. |
+hash out[104]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y|
+| 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.|
+| 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.|
+| fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C|
+| 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.|
+| 96 e3 19 07 78 39 33 4d |....x93M |
+PRF out[104]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y|
+| 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.|
+| 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.|
+| fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C|
+| 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.|
+| 96 e3 19 07 78 39 33 4d |....x93M |
+key expansion[104]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y|
+| 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.|
+| 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.|
+| fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C|
+| 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.|
+| 96 e3 19 07 78 39 33 4d |....x93M |
+Client MAC key[20]:
+| 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..|
+| 3c ce 6b f0 |<.k. |
+Server MAC key[20]:
+| 30 ee 49 3c fb d8 10 c7 05 7c 13 79 3c 91 60 64 |0.I<.....|.y<.`d|
+| 2a 4e ed e4 |*N.. |
+Client Write key[16]:
+| de d9 bd 5c e4 4d 4e 87 7e a9 5a 6f 5b ac 18 dc |...\.MN.~.Zo[...|
+Server Write key[16]:
+| 28 1a 17 90 36 80 46 0e fb 4a 5a e3 73 e9 15 48 |(...6.F..JZ.s..H|
+Client Write IV[16]:
+| 1b d9 94 9e 81 f9 25 43 8f 95 5b af 06 3f 77 63 |......%C..[..?wc|
+Server Write IV[16]:
+| 14 7d 70 82 74 85 5c a5 96 e3 19 07 78 39 33 4d |.}p.t.\.....x93M|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.|
+| 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k|
+| 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| a1 c1 46 05 29 05 f5 ed 80 3e 6d ca cb 26 66 be |..F.)....>m..&f.|
+| 56 90 62 c8 0b ee 38 91 71 c0 2f ca 8d ae 03 ad |V.b...8.q./.....|
+| b8 1f cb d8 62 a8 51 54 1f 95 e7 15 4b 90 7f e2 |....b.QT....K...|
+| f8 bf b8 9e 8b 0e f8 b6 fe d7 5f f7 18 1a 3b 60 |.........._...;`|
+Plaintext[64]:
+| 26 7d a6 22 45 f3 c6 ce 4d 75 84 3f 92 8d 57 ef |&}."E...Mu.?..W.|
+| 14 00 00 0c 39 8f f6 d9 2c 21 01 78 43 1b 26 fa |....9...,!.xC.&.|
+| e0 da 79 2a c4 14 00 0c 14 61 15 0a 07 66 56 fd |..y*.....a...fV.|
+| 98 8a 85 a2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e0 da 79 2a c4 14 00 0c 14 61 15 0a 07 66 56 fd |..y*.....a...fV.|
+| 98 8a 85 a2 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #504 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 06 45 ae f9 af 1a 81 4d 26 c4 63 c7 fd 3e b3 9c |.E.....M&.c..>..|
+| 16 d6 0f a2 95 bf 75 0d 5a 4b c4 df 06 8b 0e 99 |......u.ZK......|
+| 8f 0e 9b 9b fc e8 2f 5c 8e ba 9b 8a 49 3e 93 51 |....../\....I>.Q|
+| cc 6f 0e 9a 18 2a 46 5e 9e 10 4e ab f2 bb fe d9 |.o...*F^..N.....|
+Plaintext[64]:
+| 94 0e 11 48 51 3a 0b 9b 94 a9 43 7d 3f a3 70 69 |...HQ:....C}?.pi|
+| 14 00 00 0c a1 2f 1b 1f a6 87 0e e7 1d 08 05 fe |...../..........|
+| 4c cb 7a 61 12 8b e5 bc 76 2a fd 27 fc 9a 54 a2 |L.za....v*.'..T.|
+| ff 9e 5b 03 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..[.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4c cb 7a 61 12 8b e5 bc 76 2a fd 27 fc 9a 54 a2 |L.za....v*.'..T.|
+| ff 9e 5b 03 |..[. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #505 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 5b 32 33 80 67 98 f0 77 14 da 1d 98 43 59 16 49 |[23.g..w....CY.I|
+| 27 ae 49 2f aa 89 7a 77 a2 1f 2b cb 24 ff 93 ea |'.I/..zw..+.$...|
+| 5e ca 07 b9 1f 4e d7 f7 6d 53 d9 2d d2 e9 4b bf |^....N..mS.-..K.|
+| 8d 44 eb 28 52 b0 2a 36 a9 0b a8 2e 32 3b 59 13 |.D.(R.*6....2;Y.|
+| a2 1c 8d 6f 42 c2 1c ab 75 14 9d 48 04 a0 03 2c |...oB...u..H...,|
+| 95 00 d7 14 4e d3 3f 52 d1 52 3c ff 86 e6 f4 8d |....N.?R.R<.....|
+| f0 60 83 8b 85 19 18 04 26 4f 84 94 44 e4 3e 6a |.`......&O..D.>j|
+| 1b c3 17 25 cf b5 30 fd db b2 5b 6a cf df c6 32 |...%..0...[j...2|
+Plaintext[128]:
+| c5 d0 f3 8a f6 92 89 0d 9d cd 43 41 14 4f f7 39 |..........CA.O.9|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a 70 fc 2f d0 |.nl:4485....p./.|
+| d4 f6 49 2f 5a 35 1f 26 6f c9 a2 65 45 72 90 f4 |..I/Z5.&o..eEr..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 112
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 76 79 ac e0 65 55 32 b8 45 8b db 31 7f be 3a 0e |vy..eU2.E..1..:.|
+| 1d 9f a0 95 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 39630 found (nil)
+association_find: TCP port 4485 found 0x3430ed0
+
+dissect_ssl enter frame #506 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 80 7c 26 53 16 c3 6f fa 4e b1 0b 83 19 e9 6a 3b |.|&S..o.N.....j;|
+| 34 08 c9 54 17 b9 fd 53 6e b1 9a 45 3a b0 55 33 |4..T...Sn..E:.U3|
+| 98 8a b8 47 30 35 a9 5c a3 19 25 ec 6b 12 17 70 |...G05.\..%.k..p|
+| 8c a5 ba de b5 b1 11 2e 89 6c 4a 19 87 cc 08 9d |.........lJ.....|
+| 25 6e c1 d2 1f 13 92 e7 bc 2a 23 6c 19 13 a0 59 |%n.......*#l...Y|
+| 6e d2 a3 30 fc 64 6f b3 c2 d6 ec eb 00 e3 4e b5 |n..0.do.......N.|
+| 38 b3 83 34 f7 f4 26 c2 be 46 7d d0 35 8c 75 5d |8..4..&..F}.5.u]|
+| f8 9e 69 07 88 8f ae b6 9d 9f fb 93 c5 7e 73 a5 |..i..........~s.|
+| 5c 0f 90 f9 39 18 81 b5 c6 7a 6e 8c 2d 30 6c 54 |\...9....zn.-0lT|
+| f4 3e 0a 0d 56 82 e5 bb 73 32 a5 e9 0d ce f0 f4 |.>..V...s2......|
+| 0a d2 07 ad cd a8 db 9d c2 4b ff 28 ac d1 7d 82 |.........K.(..}.|
+| b3 52 7f 3b 4b ac 27 70 78 93 db 07 c6 25 1b dc |.R.;K.'px....%..|
+| 0a bc 8d 10 c2 5e d1 a1 3d 76 1b bf da dd a2 63 |.....^..=v.....c|
+| 86 94 60 2a 00 b4 68 c1 54 ba 3b 1a 57 0f 2e 7b |..`*..h.T.;.W..{|
+| 46 bf 89 03 67 b5 8f 79 f2 90 61 94 c9 d3 a7 cd |F...g..y..a.....|
+| d8 32 b0 33 e0 12 52 a8 fe dc 04 2d 3e aa 4e e9 |.2.3..R....->.N.|
+| 89 8e cd 7b 80 76 4b 34 22 8d 78 4d b9 d9 a9 fa |...{.vK4".xM....|
+| 80 34 c8 b0 8d 5c 91 4d 4a 07 b7 1d f2 46 02 8b |.4...\.MJ....F..|
+| 90 fb 2d a7 b1 5d 92 a9 e4 10 e5 a4 c3 0a 34 a9 |..-..]........4.|
+| 03 53 e5 a2 8a f0 82 82 01 49 3b b7 96 7b 89 10 |.S.......I;..{..|
+| 08 5e 75 bb 91 99 7f e1 1a 0e bc f4 ae 29 01 73 |.^u..........).s|
+| cf e4 88 fa 50 a5 ed de 9f b6 83 67 b7 45 38 ea |....P......g.E8.|
+| 55 62 b0 81 bc 38 68 02 20 a2 70 05 62 89 8c 17 |Ub...8h. .p.b...|
+| d8 1d 68 b4 3d fe 15 de 59 8a 65 18 8c c6 62 8f |..h.=...Y.e...b.|
+| 74 5f 66 de 21 aa 2e 9e d2 74 cf 40 88 4e 8e cf |t_f.!....t.@.N..|
+Plaintext[400]:
+| c2 cc 2a 67 87 4f 81 bd 18 26 5e ff da 38 7a 91 |..*g.O...&^..8z.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 10 09 c7 |.nl'</script>...|
+| e4 76 39 2a 21 64 9d 41 ff 81 7d 27 6d 78 21 57 |.v9*!d.A..}'mx!W|
+| 62 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |b...............|
+ssl_decrypt_record found padding 14 final len 385
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a4 04 59 eb b1 ac 1c 11 b4 8d 3f d2 9e e1 12 28 |..Y.......?....(|
+| 81 3b 8d 4c |.;.L |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4485 found 0x3430ed0
+
+dissect_ssl enter frame #507 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9b 73 db fb 73 23 d2 0b 97 1e 94 d4 94 08 41 dd |.s..s#........A.|
+| 8c c4 ce b2 35 79 cd 87 fb 7c d9 f7 9a 56 5c 5d |....5y...|...V\]|
+| ea 9c ca 29 31 d4 17 28 69 0f 68 7c a5 7c 53 98 |...)1..(i.h|.|S.|
+Plaintext[48]:
+| 44 6d 88 f1 45 a7 2a 3a c3 43 d1 5a e3 f0 57 ac |Dm..E.*:.C.Z..W.|
+| 01 00 0c 9c 89 8e 10 6c 5b 1a 77 f5 ce 0c 8f 76 |.......l[.w....v|
+| 42 ce 86 fd 85 5d 09 09 09 09 09 09 09 09 09 09 |B....]..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0c 9c 89 8e 10 6c 5b 1a 77 f5 ce 0c 8f 76 42 ce |.....l[.w....vB.|
+| 86 fd 85 5d |...] |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #509 (first time)
+ conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d8 50 4e 35 32 91 d7 a2 c0 7b 48 ef 68 c7 10 96 |.PN52....{H.h...|
+| 51 8d ba a7 e0 7c 9e 68 81 77 98 05 03 d1 3c 23 |Q....|.h.w....<#|
+| a9 cf 2a 08 d6 f4 41 76 61 51 f0 72 52 ac 07 19 |..*...AvaQ.rR...|
+Plaintext[48]:
+| f3 bd 87 f6 5f f2 79 05 bd 9c 06 19 18 e8 5c 0b |...._.y.......\.|
+| 01 00 62 77 fc 01 b2 af 45 00 f8 2a 23 37 7d 42 |..bw....E..*#7}B|
+| a3 e6 b2 7d 45 40 09 09 09 09 09 09 09 09 09 09 |...}E@..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 62 77 fc 01 b2 af 45 00 f8 2a 23 37 7d 42 a3 e6 |bw....E..*#7}B..|
+| b2 7d 45 40 |.}E@ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #514 (first time)
+ssl_session_init: initializing ptr 0x7facc385ef50 size 688
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 48166 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4486
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #516 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 750
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.|
+| 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k|
+| 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 1d 17 49 82 95 63 01 08 6e d9 2b ab 07 d2 cb |&..I..c..n.+....|
+| c2 f3 00 87 8f 81 35 45 61 98 f1 f4 38 52 34 bf |......5Ea...8R4.|
+| 26 21 49 16 45 7a 4a c3 9d 83 2c 5c e1 ab ea 41 |&!I.EzJ...,\...A|
+| 1f 00 f2 39 be 71 bd c0 87 f9 a3 72 32 |...9.q.....r2 |
+hash out[136]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.|
+| c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C|
+| a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..|
+| e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....|
+| 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...|
+| 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..|
+| 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r|
+| ce aa a9 e7 91 d5 16 7a |.......z |
+PRF out[136]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.|
+| c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C|
+| a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..|
+| e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....|
+| 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...|
+| 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..|
+| 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r|
+| ce aa a9 e7 91 d5 16 7a |.......z |
+key expansion[136]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.|
+| c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C|
+| a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..|
+| e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....|
+| 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...|
+| 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..|
+| 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r|
+| ce aa a9 e7 91 d5 16 7a |.......z |
+Client MAC key[20]:
+| e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q|
+| 56 f2 6a 06 |V.j. |
+Server MAC key[20]:
+| 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 c7 ee 3a a3 |...8..=|.)&...:.|
+| 2f 06 1a 65 |/..e |
+Client Write key[32]:
+| 59 34 80 fb ff 4c c1 43 a3 55 f7 15 9d 0a 10 96 |Y4...L.C.U......|
+| bb 94 4a e9 92 33 cd 95 e8 ae 8c be 72 3d b8 5b |..J..3......r=.[|
+Server Write key[32]:
+| 7e 8c 72 8d bf 83 96 02 5d 79 1a 77 ba 1d de e7 |~.r.....]y.w....|
+| 9c 85 d9 ca 6c 8d cd 09 12 0e 6a 7f 1e 30 50 98 |....l.....j..0P.|
+Client Write IV[16]:
+| dc 8f 0c 1a 3f 47 0b cb 9d 8a 7c a0 95 18 ae 73 |....?G....|....s|
+Server Write IV[16]:
+| e4 d8 e8 c1 f0 2d da 72 ce aa a9 e7 91 d5 16 7a |.....-.r.......z|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 679
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 480, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556
+ record: offset = 556, reported_length_remaining = 194
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 180, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741
+ record: offset = 741, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750
+
+dissect_ssl enter frame #518 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be...
+looking for RSA pre-master4104b796016af771dcad1b81edf48ced974e752bb098d260...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....|
+| 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...|
+| d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 1d 17 49 82 95 63 01 08 6e d9 2b ab 07 d2 cb |&..I..c..n.+....|
+| c2 f3 00 87 8f 81 35 45 61 98 f1 f4 38 52 34 bf |......5Ea...8R4.|
+| 26 21 49 16 45 7a 4a c3 9d 83 2c 5c e1 ab ea 41 |&!I.EzJ...,\...A|
+| 1f 00 f2 39 be 71 bd c0 87 f9 a3 72 32 |...9.q.....r2 |
+hash out[136]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[|
+| f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...|
+| 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....|
+| b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}|
+| 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..|
+| 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$.<Y}..4..Aq.b|
+| f5 67 f7 5f 5d 38 dc ed 73 9f 25 90 7a fd a3 8c |.g._]8..s.%.z...|
+| 1a 53 f0 85 91 90 fb f8 |.S...... |
+PRF out[136]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[|
+| f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...|
+| 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....|
+| b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}|
+| 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..|
+| 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$.<Y}..4..Aq.b|
+| f5 67 f7 5f 5d 38 dc ed 73 9f 25 90 7a fd a3 8c |.g._]8..s.%.z...|
+| 1a 53 f0 85 91 90 fb f8 |.S...... |
+key expansion[136]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[|
+| f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...|
+| 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....|
+| b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}|
+| 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..|
+| 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$.<Y}..4..Aq.b|
+| f5 67 f7 5f 5d 38 dc ed 73 9f 25 90 7a fd a3 8c |.g._]8..s.%.z...|
+| 1a 53 f0 85 91 90 fb f8 |.S...... |
+Client MAC key[20]:
+| d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.|
+| bc 4a a8 6f |.J.o |
+Server MAC key[20]:
+| b6 e2 92 c4 17 69 b3 25 5d 46 37 5b f1 51 46 3b |.....i.%]F7[.QF;|
+| 24 1f 78 a2 |$.x. |
+Client Write key[32]:
+| 8c 5e 82 f8 36 d9 cc d4 4b 68 c3 9a 9d 9c 65 27 |.^..6...Kh....e'|
+| 6a 77 21 6f d4 1f bb a1 b7 a8 0b 46 29 40 15 fb |jw!o.......F)@..|
+Server Write key[32]:
+| 61 e5 49 42 45 85 53 7d 78 75 a5 b3 43 2a c6 21 |a.IBE.S}xu..C*.!|
+| 07 67 38 71 eb 7a 9c 14 07 e5 24 a8 3c 59 7d c0 |.g8q.z....$.<Y}.|
+Client Write IV[16]:
+| 89 34 b2 12 41 71 87 62 f5 67 f7 5f 5d 38 dc ed |.4..Aq.b.g._]8..|
+Server Write IV[16]:
+| 73 9f 25 90 7a fd a3 8c 1a 53 f0 85 91 90 fb f8 |s.%.z....S......|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....|
+| 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...|
+| d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 4a 57 4a 80 30 d0 18 20 e3 de 03 2e 95 99 71 78 |JWJ.0.. ......qx|
+| 80 a3 e1 ec ae fd e8 eb 16 90 59 5e 47 e0 51 8f |..........Y^G.Q.|
+| 23 0f 56 ae 09 5a bc b6 ce a4 f9 5e 30 75 08 55 |#.V..Z.....^0u.U|
+| 00 9a 38 de 1b d3 e6 09 b1 7c 8c a0 0d 02 88 48 |..8......|.....H|
+Plaintext[64]:
+| fc 67 be 64 e3 79 75 67 9b ac f2 29 5d 16 3e f6 |.g.d.yug...)].>.|
+| 14 00 00 0c 93 d9 61 28 a3 1f a7 bd 3e 31 8f 93 |......a(....>1..|
+| 45 a9 4a 29 49 80 d3 14 78 90 23 35 aa b2 69 2f |E.J)I...x.#5..i/|
+| c7 f4 14 8f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 45 a9 4a 29 49 80 d3 14 78 90 23 35 aa b2 69 2f |E.J)I...x.#5..i/|
+| c7 f4 14 8f |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #519 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 28 2b 33 59 8b 05 e9 31 60 30 04 e6 27 d6 05 54 |(+3Y...1`0..'..T|
+| 4d e8 27 61 c1 68 43 f4 1f 1c 6c a5 e0 44 b5 49 |M.'a.hC...l..D.I|
+| 39 d5 0e 3e dc 4f 3e fe 8a ad 6a 81 ee f9 73 7d |9..>.O>...j...s}|
+| c4 75 1a a9 f9 92 72 28 68 5c 3c ca 15 a8 81 a1 |.u....r(h\<.....|
+Plaintext[64]:
+| d0 f2 0d ac 72 be 66 e9 83 17 40 ff c5 20 41 3f |....r.f...@.. A?|
+| 14 00 00 0c d2 d3 c7 2e be 8c 5e 86 fd 6b 31 20 |..........^..k1 |
+| 78 64 aa 67 e8 2d 60 9d 66 24 78 4e 4d 89 67 dd |xd.g.-`.f$xNM.g.|
+| b0 d5 b5 c7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 78 64 aa 67 e8 2d 60 9d 66 24 78 4e 4d 89 67 dd |xd.g.-`.f$xNM.g.|
+| b0 d5 b5 c7 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #520 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| c1 6c b4 be 02 d2 8d d8 8a 0d 25 5b 7f 2c b1 c4 |.l........%[.,..|
+| 0d f0 82 4c d6 d0 bf d5 55 5c 4f e1 8a 2d 37 06 |...L....U\O..-7.|
+| 30 17 d8 ba 48 e3 36 71 3b 80 a7 83 1f fe e9 7f |0...H.6q;.......|
+| 2f 91 f0 1a f3 8a 49 75 a6 0e 3e b2 de 50 40 fb |/.....Iu..>..P@.|
+| 59 eb 72 f7 fb 80 e7 d6 05 16 26 0f a9 fa 5b e5 |Y.r.......&...[.|
+| 31 3d 99 0e f8 be ae 23 79 3b 5f 7e d9 25 1b b9 |1=.....#y;_~.%..|
+| 7d 02 de 29 20 d6 6b 64 90 b0 7e f8 99 5b 4c c2 |}..) .kd..~..[L.|
+| a7 60 fa 58 b6 d5 56 dd b2 cf 49 bd 67 8b 37 b4 |.`.X..V...I.g.7.|
+Plaintext[128]:
+| 2a 6b 15 42 04 6d 93 85 dd 8b f9 e3 dc 29 af 36 |*k.B.m.......).6|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds|
+| 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a ef c9 47 c8 |.nl:4486......G.|
+| c3 10 9c 61 c5 26 54 1d 13 0e 12 d5 61 2c 0c 21 |...a.&T.....a,.!|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 112
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 95 66 5b 10 09 6d db 3e c2 bf a6 a1 e2 87 54 d1 |.f[..m.>......T.|
+| 70 e6 bf 5b |p..[ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 48166 found (nil)
+association_find: TCP port 4486 found 0x3430f60
+
+dissect_ssl enter frame #521 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e5 c4 9c c4 15 61 f8 ff fd 42 16 fc 66 51 d1 49 |.....a...B..fQ.I|
+| 5b 8b ae eb 95 d1 b2 7d 28 b5 7e 16 43 24 42 b8 |[......}(.~.C$B.|
+| a2 00 7b 87 2a 66 a7 b8 79 72 61 8f 58 0d 5b 5d |..{.*f..yra.X.[]|
+| 13 a3 4f 0c 64 a5 df 8a 5d 9f fc 90 5c 4a 73 78 |..O.d...]...\Jsx|
+| ca 50 49 8b 71 49 24 9e c3 c5 73 0f 63 92 56 8c |.PI.qI$...s.c.V.|
+| 09 4d 55 84 d6 63 1d 34 36 f9 c6 05 19 ac 8c 03 |.MU..c.46.......|
+| 19 48 62 da 4a 67 05 01 75 7a ce bb 56 3f 6f 65 |.Hb.Jg..uz..V?oe|
+| a6 fb b7 24 f7 df 67 83 66 0c 23 fb 3b b0 94 de |...$..g.f.#.;...|
+| 3d 5a c2 47 a7 5e e1 64 a9 f4 ea 47 6c da 18 cc |=Z.G.^.d...Gl...|
+| ea 6e 05 41 7a aa 28 9d 54 00 0f 8f dd 7b 3a 2f |.n.Az.(.T....{:/|
+| a0 8a f6 61 66 af 99 32 ed c8 00 15 ce 27 7b 21 |...af..2.....'{!|
+| 4a 5a e9 51 76 cc 4d d3 a5 5f ac 41 ee 21 d7 01 |JZ.Qv.M.._.A.!..|
+| 88 6a 30 5b aa 1b 6c c4 5a c3 49 5f 8b a6 d4 23 |.j0[..l.Z.I_...#|
+| 71 ba 26 79 8c e0 81 50 19 63 ab 0a 1a 52 8e 28 |q.&y...P.c...R.(|
+| eb dd 4e 53 e9 22 70 d6 5e c7 5c 49 b9 84 53 28 |..NS."p.^.\I..S(|
+| 85 bd 12 0d 69 0a 96 44 ec 60 b3 db 9e 3e 5a 37 |....i..D.`...>Z7|
+| f9 04 ef 36 70 62 11 70 c3 96 50 12 25 18 7c a2 |...6pb.p..P.%.|.|
+| 7a 97 60 ae 31 07 98 bc 02 a3 c8 92 7b 95 b2 2d |z.`.1.......{..-|
+| dd b1 c4 c1 a5 b5 b6 e1 d0 6a 4d 6c 1b 46 be 5a |.........jMl.F.Z|
+| d9 b5 e2 e4 e6 49 e9 4d 1f f7 2b ca 20 63 67 d2 |.....I.M..+. cg.|
+| dd b8 b1 46 ac b7 fc 01 f6 9f f5 b0 43 66 d3 ec |...F........Cf..|
+| fc e6 22 01 cc 68 37 dd 11 6b d4 e3 21 91 3a fb |.."..h7..k..!.:.|
+| ea 40 bb 38 8c 95 dd 70 38 de d7 a0 2b 66 06 cc |.@.8...p8...+f..|
+| 79 38 8e 7d d0 98 ab 64 52 7e e2 24 4d b9 65 c0 |y8.}...dR~.$M.e.|
+| 7a ad 51 4f 25 12 35 b4 01 c5 7e 92 2d f5 1b 42 |z.QO%.5...~.-..B|
+Plaintext[400]:
+| e6 3e 5c 96 06 2e a4 70 a7 58 3a 5a 78 3d 6a 14 |.>\....p.X:Zx=j.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE|
+| 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH|
+| 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En|
+| 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=|
+| 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1<script>docu|
+| 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc|
+| 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn|
+| 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ac 9e e7 |.nl'</script>...|
+| 7a f7 c3 96 8f fd 57 31 af b8 f0 fd b8 51 45 70 |z.....W1.....QEp|
+| b4 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 385
+checking mac (len 349, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 9a c5 1d 56 8c a5 21 6a 92 8c 09 31 01 b9 8e |....V..!j...1...|
+| 90 09 a8 87 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4486 found 0x3430f60
+
+dissect_ssl enter frame #522 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b9 be 9e b1 fe 22 91 9d 9f 5b 1b 3b d7 a2 a1 4c |....."...[.;...L|
+| a6 a9 64 0c b6 2a f6 77 25 be 63 0c 57 8c 4e 59 |..d..*.w%.c.W.NY|
+| b1 c0 16 7b 2f 05 a6 a2 60 e9 e0 d7 5f da 4d de |...{/...`..._.M.|
+Plaintext[48]:
+| c9 63 38 c9 1f 7b e2 32 4c 53 87 08 a1 3d 3f 29 |.c8..{.2LS...=?)|
+| 01 00 c0 5e 0b 48 f9 ef 00 38 04 9e 69 cf ab 19 |...^.H...8..i...|
+| 1f f1 e4 cf 78 b6 09 09 09 09 09 09 09 09 09 09 |....x...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c0 5e 0b 48 f9 ef 00 38 04 9e 69 cf ab 19 1f f1 |.^.H...8..i.....|
+| e4 cf 78 b6 |..x. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #524 (first time)
+ conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c9 36 0f 15 31 65 21 e1 dd 68 d6 16 d3 c0 a7 27 |.6..1e!..h.....'|
+| 1f 64 aa f6 4e 12 88 10 32 57 7a 2e 4c 04 27 be |.d..N...2Wz.L.'.|
+| f3 ee 15 07 1c 01 e6 59 06 56 37 c1 2c 70 41 fe |.......Y.V7.,pA.|
+Plaintext[48]:
+| a9 c4 f0 c5 40 e2 ea ba 1f 98 00 3d 48 b1 43 74 |....@......=H.Ct|
+| 01 00 91 24 a6 88 14 43 8f ff 91 c7 5a 2c ec fe |...$...C....Z,..|
+| 6c 80 09 b9 45 61 09 09 09 09 09 09 09 09 09 09 |l...Ea..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 91 24 a6 88 14 43 8f ff 91 c7 5a 2c ec fe 6c 80 |.$...C....Z,..l.|
+| 09 b9 45 61 |..Ea |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #529 (first time)
+ssl_session_init: initializing ptr 0x7facc3861410 size 688
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 57501 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4491
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #531 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC011 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....|
+| 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...|
+| d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 54 48 16 d3 cd 07 60 9f 77 62 60 51 f0 f4 79 |&TH....`.wb`Q..y|
+| 00 e3 f1 66 90 46 20 6e 28 70 93 eb 20 52 34 bf |...f.F n(p.. R4.|
+| 26 c8 be 86 bf b1 14 f1 61 cf ec 4d 6f d9 a4 61 |&.......a..Mo..a|
+| 17 e4 4d 82 f6 8e 38 1c 7d 69 27 01 f7 |..M...8.}i'.. |
+hash out[72]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_|
+| 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;|
+| 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\|
+| b7 d9 51 bf c3 f0 36 0c |..Q...6. |
+PRF out[72]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_|
+| 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;|
+| 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\|
+| b7 d9 51 bf c3 f0 36 0c |..Q...6. |
+key expansion[72]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_|
+| 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;|
+| 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\|
+| b7 d9 51 bf c3 f0 36 0c |..Q...6. |
+Client MAC key[20]:
+| f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..|
+| 37 80 6a cf |7.j. |
+Server MAC key[20]:
+| fb 50 89 e5 61 84 48 08 d0 52 40 5f 56 7a 01 f3 |.P..a.H..R@_Vz..|
+| 4e 10 82 91 |N... |
+Client Write key[16]:
+| ec 3a ef 45 ce 8f f9 3b 0f 5e c1 91 e2 03 35 82 |.:.E...;.^....5.|
+Server Write key[16]:
+| 87 82 b9 1c ab 07 d8 5c b7 d9 51 bf c3 f0 36 0c |.......\..Q...6.|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 14 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #533 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 122
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f6...
+looking for RSA pre-master4104ea3d5891a5452e2664fae464b13c68e6d659a0d51bba...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..|
+| ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.|
+| 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 54 48 16 d3 cd 07 60 9f 77 62 60 51 f0 f4 79 |&TH....`.wb`Q..y|
+| 00 e3 f1 66 90 46 20 6e 28 70 93 eb 20 52 34 bf |...f.F n(p.. R4.|
+| 26 c8 be 86 bf b1 14 f1 61 cf ec 4d 6f d9 a4 61 |&.......a..Mo..a|
+| 17 e4 4d 82 f6 8e 38 1c 7d 69 27 01 f7 |..M...8.}i'.. |
+hash out[72]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf|
+| fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A|
+| ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G|
+| 77 5f 96 38 f1 48 22 fe |w_.8.H". |
+PRF out[72]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf|
+| fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A|
+| ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G|
+| 77 5f 96 38 f1 48 22 fe |w_.8.H". |
+key expansion[72]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf|
+| fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A|
+| ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G|
+| 77 5f 96 38 f1 48 22 fe |w_.8.H". |
+Client MAC key[20]:
+| 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[|
+| 2e 44 aa 56 |.D.V |
+Server MAC key[20]:
+| 15 78 34 7e a2 88 dd 51 f2 2f 67 66 fc 52 52 8e |.x4~...Q./gf.RR.|
+| 78 51 d6 56 |xQ.V |
+Client Write key[16]:
+| d4 bf 40 1f bf 39 c4 41 ad 9a 53 d9 f6 eb 8d 8a |..@..9.A..S.....|
+Server Write key[16]:
+| 4c b1 f2 62 68 91 3f 47 77 5f 96 38 f1 48 22 fe |L..bh.?Gw_.8.H".|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..|
+| ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.|
+| 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 63 0c b4 36 af 40 02 fc 08 c8 24 f7 2e f3 ca a6 |c..6.@....$.....|
+| 72 07 ee 48 c5 e0 78 1a a5 b0 74 29 ed cc 9a ce |r..H..x...t)....|
+| 5c ad dc d2 |\... |
+Plaintext[36]:
+| 14 00 00 0c 1f a1 4a 75 76 c8 9c 7c 6c 22 e2 4c |......Juv..|l".L|
+| 05 a0 ef b1 a8 00 d8 9f da bd 75 4c 50 9e 04 be |..........uLP...|
+| 39 aa 0c b4 |9... |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 05 a0 ef b1 a8 00 d8 9f da bd 75 4c 50 9e 04 be |..........uLP...|
+| 39 aa 0c b4 |9... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #534 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 1a a6 19 a1 55 f1 6c 65 10 27 08 ad 0c 3c 0f 7e |....U.le.'...<.~|
+| 4b e0 90 47 26 e5 97 4d d3 75 d1 1f 6f 5b 15 6e |K..G&..M.u..o[.n|
+| 55 92 4d d3 |U.M. |
+Plaintext[36]:
+| 14 00 00 0c b3 19 f6 37 e4 56 be 99 32 d4 d1 5a |.......7.V..2..Z|
+| 71 f7 cf 2a db 3b 14 d6 b8 5c b6 e3 51 44 02 6e |q..*.;...\..QD.n|
+| 2c a8 cf 4a |,..J |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 71 f7 cf 2a db 3b 14 d6 b8 5c b6 e3 51 44 02 6e |q..*.;...\..QD.n|
+| 2c a8 cf 4a |,..J |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #535 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 96
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 91, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 91
+Ciphertext[91]:
+| 03 c4 fe d6 32 19 9e 23 82 79 a1 8d 42 14 5e 4d |....2..#.y..B.^M|
+| ea e9 54 65 1b 74 be fb c8 37 ac 51 e0 f6 8b 48 |..Te.t...7.Q...H|
+| f0 fa b2 e5 60 e5 16 75 71 b8 04 9b e6 8c 83 92 |....`..uq.......|
+| 3a 7f 48 b8 eb d7 0b 4c 7d bc 87 9d 44 50 fe 89 |:.H....L}...DP..|
+| e6 4f cb d3 1f 13 21 a5 ab ab b9 e6 b7 dc 5e fd |.O....!.......^.|
+| 0f c0 ef 9b 70 a5 d7 43 89 7f ac |....p..C... |
+Plaintext[91]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a 93 11 f4 3a e1 af 2a 80 60 |491.......:..*.`|
+| 9e 35 ab 35 c9 a3 a5 0f ba e5 b7 |.5.5....... |
+checking mac (len 71, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 93 11 f4 3a e1 af 2a 80 60 9e 35 ab 35 c9 a3 a5 |...:..*.`.5.5...|
+| 0f ba e5 b7 |.... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 71, seq = 0, nxtseq = 71
+association_find: TCP port 57501 found (nil)
+association_find: TCP port 4491 found 0x3431840
+dissect_ssl3_record decrypted len 71
+decrypted app data fragment[71]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al|
+| 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4|
+| 34 39 31 0d 0a 0d 0a |491.... |
+dissect_ssl3_record found association 0x3431840
+
+dissect_ssl enter frame #536 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| ea 1a dc 71 3a e8 49 57 84 35 3b a9 4f 54 f2 a4 |...q:.IW.5;.OT..|
+| 1e f7 61 e5 c0 84 8d 7a 5d a8 64 13 79 04 08 3a |..a....z].d.y..:|
+| 78 f3 ca fc cb f9 82 d6 78 85 ae e0 2c e3 4c 30 |x.......x...,.L0|
+| 7e c8 9b bb 38 b1 4e 37 fe 62 da 37 2f 6e 81 fc |~...8.N7.b.7/n..|
+| c1 ea 66 a7 da 12 cf 70 7f cb b7 3a 26 10 e8 86 |..f....p...:&...|
+| d3 96 30 6c 3a 49 1a 97 d2 9c e1 f2 c8 34 a7 9b |..0l:I.......4..|
+| 18 e1 59 c2 9d 89 09 e7 00 a0 40 86 49 7c 0e 10 |..Y.......@.I|..|
+| e2 77 40 6f ad cd ca 05 e6 29 09 6e f2 1f 96 ee |.w@o.....).n....|
+| 3c bf 32 bb 39 a8 da 5a 79 74 ec 0f 68 27 6b 75 |<.2.9..Zyt..h'ku|
+| b6 69 6e e1 8c 80 99 af 00 a1 3d c8 30 b7 4e 51 |.in.......=.0.NQ|
+| 60 77 d2 02 a9 16 a3 1b 91 c1 c9 00 8d 24 49 48 |`w...........$IH|
+| 8f 59 51 94 3b 70 2a fe 25 26 0a 17 ea e2 9e 8c |.YQ.;p*.%&......|
+| 95 fe 27 29 9d 6a fb 23 b0 fd a6 84 1e 5e b5 34 |..').j.#.....^.4|
+| ee cc 6a 92 05 84 cb 36 e1 a0 4c 5b 13 99 3d f3 |..j....6..L[..=.|
+| 76 3f 85 35 0f bd 81 f0 99 bd 54 5b 2a 6b 55 dd |v?.5......T[*kU.|
+| 2e dc 6e df 7f 51 3c 66 89 76 35 e2 09 ab 85 e3 |..n..Q<f.v5.....|
+| 46 d9 49 b2 05 4f c6 9b 80 95 21 29 b5 40 05 97 |F.I..O....!).@..|
+| 7a 03 a0 45 06 69 5f 91 33 91 f7 ba 50 5e eb 71 |z..E.i_.3...P^.q|
+| 25 cc c9 2f 78 90 86 b0 bf 21 a9 71 66 f6 81 46 |%../x....!.qf..F|
+| 95 30 28 5e 30 0f 7c b5 ea 82 c0 a2 2b bf 1e 71 |.0(^0.|.....+..q|
+| b4 7d 50 4a 8e 66 eb ae eb f0 ba 72 c4 8c 32 8b |.}PJ.f.....r..2.|
+| a3 ad f8 13 92 05 fe 1d 43 48 1e 5a 9f 2c 3c 71 |........CH.Z.,<q|
+| 33 d4 12 8f b3 13 49 4f 1a 4e 0c a4 09 9f f0 0d |3.....IO.N......|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ab a5 3d 92 |nl'</script>..=.|
+| e1 a1 74 03 2e ee 44 94 eb fb 46 bf c1 b0 ab d1 |..t...D...F.....|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ab a5 3d 92 e1 a1 74 03 2e ee 44 94 eb fb 46 bf |..=...t...D...F.|
+| c1 b0 ab d1 |.... |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4491 found 0x3431840
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE|
+| 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x3431840
+
+dissect_ssl enter frame #537 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 17 1f 56 00 42 af 59 ed 14 72 0d 9b bd ae c6 f6 |..V.B.Y..r......|
+| 94 5b cc ff 20 96 |.[.. . |
+Plaintext[22]:
+| 01 00 e1 74 23 83 48 30 f3 84 07 e4 15 cf 10 0b |...t#.H0........|
+| 7c eb 9f c5 d8 5d ||....] |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 74 23 83 48 30 f3 84 07 e4 15 cf 10 0b 7c eb |.t#.H0........|.|
+| 9f c5 d8 5d |...] |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #539 (first time)
+ conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 38 00 8b 45 cb 30 36 09 3e 69 16 08 49 66 be af |8..E.06.>i..If..|
+| b0 b4 30 1f cc 25 |..0..% |
+Plaintext[22]:
+| 01 00 50 dd 9e c8 b8 83 66 09 ea 7b 07 17 3b a1 |..P.....f..{..;.|
+| bf 7b de d4 9d e5 |.{.... |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 50 dd 9e c8 b8 83 66 09 ea 7b 07 17 3b a1 bf 7b |P.....f..{..;..{|
+| de d4 9d e5 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #544 (first time)
+ssl_session_init: initializing ptr 0x7facc3863d20 size 688
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34592 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4492
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #546 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..|
+| ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.|
+| 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 e5 39 48 98 98 bf fa 5b 4d 1e 24 c8 88 c7 30 |&.9H....[M.$...0|
+| e7 0b 48 99 89 63 f6 10 fa 0c 1c 1f 10 52 34 bf |..H..c.......R4.|
+| 26 d7 23 92 e6 c6 7c c5 69 c9 dc 18 61 0f fd df |&.#...|.i...a...|
+| 12 47 42 b6 8e f9 50 e4 35 7b 73 1a 99 |.GB...P.5{s.. |
+hash out[104]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o|
+| d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..|
+| 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..|
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h|
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+PRF out[104]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o|
+| d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..|
+| 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..|
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h|
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+key expansion[104]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o|
+| d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..|
+| 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..|
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h|
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+Client MAC key[20]:
+| e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{|
+| bf 41 98 5e |.A.^ |
+Server MAC key[20]:
+| 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f d3 5d 9f fc |..&a4......o.]..|
+| 53 20 52 6e |S Rn |
+Client Write key[24]:
+| 3e 96 18 82 b4 45 c5 1c 93 65 6f 96 76 b5 2c 54 |>....E...eo.v.,T|
+| 1f 7f 4c ce cb 4d 89 ee |..L..M.. |
+Server Write key[24]:
+| ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax|
+| 28 a4 18 27 57 74 9e 11 |(..'Wt.. |
+Client Write IV[8]:
+| 26 03 a8 e7 05 fc cf 68 |&......h |
+Server Write IV[8]:
+| 8c 8f 44 bb 8a 26 63 ee |..D..&c. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #548 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68e...
+looking for RSA pre-master4104eebcabcbcb46841a360b5987f25cde894bce45b8777e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.|
+| 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.|
+| 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 26 e5 39 48 98 98 bf fa 5b 4d 1e 24 c8 88 c7 30 |&.9H....[M.$...0|
+| e7 0b 48 99 89 63 f6 10 fa 0c 1c 1f 10 52 34 bf |..H..c.......R4.|
+| 26 d7 23 92 e6 c6 7c c5 69 c9 dc 18 61 0f fd df |&.#...|.i...a...|
+| 12 47 42 b6 8e f9 50 e4 35 7b 73 1a 99 |.GB...P.5{s.. |
+hash out[104]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n|
+| b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF|
+| a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...|
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF|
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+PRF out[104]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n|
+| b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF|
+| a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...|
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF|
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+key expansion[104]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n|
+| b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF|
+| a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...|
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF|
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+Client MAC key[20]:
+| 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema|
+| ce 82 db 75 |...u |
+Server MAC key[20]:
+| c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e b0 63 8a 48 |.....8.o.^.n.c.H|
+| ef 8c b8 9e |.... |
+Client Write key[24]:
+| 84 ed e3 89 57 0e 75 46 a2 2e ff f8 cd bc 14 88 |....W.uF........|
+| e4 c4 a2 1c 42 d9 bd 13 |....B... |
+Server Write key[24]:
+| 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;|
+| dd c3 6e 27 95 99 38 e8 |..n'..8. |
+Client Write IV[8]:
+| 09 4f 36 d1 e8 d0 7a 46 |.O6...zF |
+Server Write IV[8]:
+| f6 d1 b2 78 5c 07 8c 04 |...x\... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.|
+| 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.|
+| 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| a2 32 a0 6b 7d bd 41 bc ea 88 38 15 fb ec c0 8f |.2.k}.A...8.....|
+| 65 77 61 73 06 29 de 95 68 49 f5 f3 e7 0e a2 e8 |ewas.)..hI......|
+| 45 18 a0 3d 2c b1 53 30 57 c2 d9 d3 87 d6 d3 80 |E..=,.S0W.......|
+Plaintext[48]:
+| 96 bf b5 57 84 89 ea c9 14 00 00 0c e5 ed 95 02 |...W............|
+| a0 35 36 a5 e0 04 77 2c 3e 6e 31 b3 9f 64 16 87 |.56...w,>n1..d..|
+| 0c a9 c2 1c f8 22 a5 6e 14 58 bc 89 03 03 03 03 |.....".n.X......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e 6e 31 b3 9f 64 16 87 0c a9 c2 1c f8 22 a5 6e |>n1..d.......".n|
+| 14 58 bc 89 |.X.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #549 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 52 96 93 fd ce ca f6 fa 14 44 a7 22 6f 72 dc 49 |R........D."or.I|
+| e8 97 cf f5 70 eb 93 3d b9 7d c1 c5 a4 02 e7 15 |....p..=.}......|
+| 3e 07 22 dd 69 08 64 32 47 35 c0 89 ed 93 a7 e1 |>.".i.d2G5......|
+Plaintext[48]:
+| 26 18 e2 17 1b c2 1f 19 14 00 00 0c 3b 15 3c 03 |&...........;.<.|
+| ba 4c 95 4e af 14 e0 d7 8b 93 42 04 1b be ea cf |.L.N......B.....|
+| 27 61 fb 88 cd a2 05 77 1a 03 2b d5 03 03 03 03 |'a.....w..+.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8b 93 42 04 1b be ea cf 27 61 fb 88 cd a2 05 77 |..B.....'a.....w|
+| 1a 03 2b d5 |..+. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #550 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 9b 0b 21 f5 40 3e a0 f6 33 51 e5 e6 92 68 fc 97 |..!.@>..3Q...h..|
+| 36 3b fb 54 31 09 3c b2 6e 8e 66 d6 96 7b 06 b8 |6;.T1.<.n.f..{..|
+| 4c 33 10 3b a6 dd 1d 8f 5e 01 48 68 c6 c9 e5 25 |L3.;....^.Hh...%|
+| b5 f7 b4 89 56 db 66 f4 07 e4 08 48 c1 88 0c 5f |....V.f....H..._|
+| 8c cb 5e 3a af 8c 4d 46 31 3f 08 f2 28 75 59 44 |..^:..MF1?..(uYD|
+| a1 78 95 b1 ea f4 eb c4 2c e4 64 2f b2 03 5b ee |.x......,.d/..[.|
+| 62 5f b9 a9 39 3c 5d e9 61 f2 f6 43 c9 37 76 6d |b_..9<].a..C.7vm|
+Plaintext[112]:
+| b2 26 f3 4a 21 50 23 44 47 45 54 20 2f 20 48 54 |.&.J!P#DGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec|
+| 64 68 65 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 |dhe-rsa-des-cbc3|
+| 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 |-sha.local.al.le|
+| 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 39 32 |kensteyn.nl:4492|
+| 0d 0a 0d 0a 36 40 ce 3e e1 92 01 e6 93 32 8c 19 |....6@.>.....2..|
+| a6 67 46 d5 7d 3c 2e 32 07 07 07 07 07 07 07 07 |.gF.}<.2........|
+ssl_decrypt_record found padding 7 final len 104
+checking mac (len 76, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ec c3 4a d5 b1 fb a4 c8 74 d8 64 72 2c 17 0d fe |..J.....t.dr,...|
+| d9 bb de ce |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34592 found (nil)
+association_find: TCP port 4492 found 0x34318d0
+
+dissect_ssl enter frame #551 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c9 d1 11 f4 7b cc 69 dd bf 7c ab a2 bf c7 ca 2a |....{.i..|.....*|
+| 88 46 f4 a6 35 96 29 d2 31 95 41 e7 01 61 b6 e1 |.F..5.).1.A..a..|
+| 79 ed 5f fd 0c 2c 0d 6a b0 f9 0f 98 4c d9 27 14 |y._..,.j....L.'.|
+| 58 5f 6f 87 3b d8 43 2a b6 54 85 52 6b 26 6c b3 |X_o.;.C*.T.Rk&l.|
+| bf ea da a8 5c d6 eb 42 78 2d 88 c9 d2 8c fc e2 |....\..Bx-......|
+| 59 a8 19 2c 18 2a fe 40 1a 9a c6 30 d8 5f de 5d |Y..,.*.@...0._.]|
+| 19 e0 63 41 f6 12 b3 57 1b f6 af 33 a7 87 24 38 |..cA...W...3..$8|
+| 18 0c 92 4c 02 f6 77 2c e1 8c fd 3e 63 97 5c f5 |...L..w,...>c.\.|
+| 88 58 52 36 a5 6f d0 26 c6 03 93 23 d0 73 4e cb |.XR6.o.&...#.sN.|
+| 71 73 da 4b e7 e0 75 2f 7b 06 43 90 f6 0e 2e 35 |qs.K..u/{.C....5|
+| 94 e6 b2 0e d9 db 4a 3b 23 12 42 92 11 0b 66 d0 |......J;#.B...f.|
+| a0 36 6e d5 6b eb 8a e2 3a 0e 28 6e 38 75 5e 02 |.6n.k...:.(n8u^.|
+| 93 5f 11 b6 15 d2 40 77 c7 ac 58 11 0a 78 5c 2f |._....@w..X..x\/|
+| 35 88 9a d6 8d 85 1f fb b1 8e ef 3d 4b 0e 88 c1 |5..........=K...|
+| ed 7e fe 21 a9 a3 12 a0 83 30 44 3d 91 6d 18 4d |.~.!.....0D=.m.M|
+| 21 80 c5 c6 52 85 af 15 13 20 01 89 50 e7 a4 d3 |!...R.... ..P...|
+| d8 63 f2 09 74 e1 c7 6d 7b 1b 00 c0 f6 b5 08 85 |.c..t..m{.......|
+| 69 63 99 6a a3 77 26 05 38 6f 9f 72 bf 01 a1 95 |ic.j.w&.8o.r....|
+| db 06 0b 0b 68 bb 05 cd 21 0a 31 2d d7 29 91 28 |....h...!.1-.).(|
+| ff ef 30 12 8a 4d 69 0c 0f 37 ea 22 85 db 45 83 |..0..Mi..7."..E.|
+| c5 10 e4 df d8 a1 85 07 c4 99 35 df ed d9 c6 b7 |..........5.....|
+| 94 2e 54 3b bc e4 2b 3a b5 e9 56 30 11 1a 40 60 |..T;..+:..V0..@`|
+| 58 dc e5 5c f3 1b 23 1e f1 6b d3 5d ce 34 91 76 |X..\..#..k.].4.v|
+| 6e 5c ed fd b0 b0 1d 5d be 89 6f 47 67 99 b2 f9 |n\.....]..oGg...|
+Plaintext[384]:
+| 48 9b 94 99 84 7c ab 56 48 54 54 50 2f 31 2e 31 |H....|.VHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 38 20 47 4d |2013 19:55:18 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 31 32 |che....0xC0,0x12|
+| 20 2d 20 45 43 44 48 45 2d 52 53 41 2d 44 45 53 | - ECDHE-RSA-DES|
+| 2d 43 42 43 33 2d 53 48 41 20 20 53 53 4c 76 33 |-CBC3-SHA SSLv3|
+| 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 3d | Kx=ECDH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e af c1 91 8f f4 7a 7b 7e 2f ce f0 f3 |ipt>.....z{~/...|
+| c5 2c 0a 7a 35 86 16 48 07 07 07 07 07 07 07 07 |.,.z5..H........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0b 8c 9f fa 5c b9 86 2d da 90 1c fb 95 12 64 c4 |....\..-......d.|
+| ec cf 31 5d |..1] |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4492 found 0x34318d0
+
+dissect_ssl enter frame #552 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 13 87 84 14 ce 22 02 a6 e7 19 a7 17 d7 db cd 9e |....."..........|
+| 21 a9 30 2c 83 a5 3d be 91 bf 60 e4 49 ce 08 68 |!.0,..=...`.I..h|
+Plaintext[32]:
+| c6 d3 ea d3 d3 52 73 cf 01 00 b0 ca 07 80 79 bd |.....Rs.......y.|
+| 4f 17 18 cc 24 2a 62 6e c1 93 e7 fe f9 1e 01 01 |O...$*bn........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b0 ca 07 80 79 bd 4f 17 18 cc 24 2a 62 6e c1 93 |....y.O...$*bn..|
+| e7 fe f9 1e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #554 (first time)
+ conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ad 0e 58 f1 8d c2 d9 eb 7d b2 93 07 5c 0d da f0 |..X.....}...\...|
+| 7a d6 16 93 12 5c f1 63 0a 11 67 f6 ca 86 89 9a |z....\.c..g.....|
+Plaintext[32]:
+| 00 94 e0 88 23 72 8f 91 01 00 f3 37 24 45 dd 05 |....#r.....7$E..|
+| fa ae 86 00 9b ce dc ef 85 1f 16 23 75 c9 01 01 |...........#u...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f3 37 24 45 dd 05 fa ae 86 00 9b ce dc ef 85 1f |.7$E............|
+| 16 23 75 c9 |.#u. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #559 (first time)
+ssl_session_init: initializing ptr 0x7facc3866220 size 688
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55294 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4493
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #561 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.|
+| 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.|
+| 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 25 87 db 66 ce 4f af b1 e8 4f 7d a8 a9 66 d5 |'%..f.O...O}..f.|
+| 42 14 31 0f 64 4e cf ec d2 18 38 7e b1 52 34 bf |B.1.dN....8~.R4.|
+| 27 0d 31 84 a1 0d fb a3 73 43 ad 12 f1 15 c7 08 |'.1.....sC......|
+| e3 e7 46 e8 8e ff 05 15 a4 37 35 7f bc |..F......75.. |
+hash out[104]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..|
+| 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..|
+| 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d|
+| cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu|
+| f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U|
+| 19 8d 7d b8 fc 26 ea 93 |..}..&.. |
+PRF out[104]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..|
+| 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..|
+| 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d|
+| cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu|
+| f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U|
+| 19 8d 7d b8 fc 26 ea 93 |..}..&.. |
+key expansion[104]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..|
+| 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..|
+| 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d|
+| cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu|
+| f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U|
+| 19 8d 7d b8 fc 26 ea 93 |..}..&.. |
+Client MAC key[20]:
+| 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../|
+| 8e 85 e4 84 |.... |
+Server MAC key[20]:
+| 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 6f f9 19 0d |<.X..r.'N_..o...|
+| 3a 8e 97 5b |:..[ |
+Client Write key[16]:
+| 5d 6a 9f 0f e2 2f d3 10 07 21 fe 5c 30 86 8d 05 |]j.../...!.\0...|
+Server Write key[16]:
+| 82 f6 10 4e 8c ba 3a 64 cd 78 2e 52 5b a6 ed 51 |...N..:d.x.R[..Q|
+Client Write IV[16]:
+| c0 fb f6 0b 25 aa 6e 75 f1 fe a7 c2 26 39 b2 9d |....%.nu....&9..|
+Server Write IV[16]:
+| 8c 04 da 95 a6 53 c4 55 19 8d 7d b8 fc 26 ea 93 |.....S.U..}..&..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #563 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88e...
+looking for RSA pre-master4104c46d44bde4db0259182c556118f4cc0c5e9c77bccce0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..|
+| 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....|
+| 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 25 87 db 66 ce 4f af b1 e8 4f 7d a8 a9 66 d5 |'%..f.O...O}..f.|
+| 42 14 31 0f 64 4e cf ec d2 18 38 7e b1 52 34 bf |B.1.dN....8~.R4.|
+| 27 0d 31 84 a1 0d fb a3 73 43 ad 12 f1 15 c7 08 |'.1.....sC......|
+| e3 e7 46 e8 8e ff 05 15 a4 37 35 7f bc |..F......75.. |
+hash out[104]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.|
+| f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.|
+| 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.|
+| 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..|
+| 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......|
+| c3 54 53 f2 2e 3f 8a b3 |.TS..?.. |
+PRF out[104]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.|
+| f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.|
+| 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.|
+| 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..|
+| 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......|
+| c3 54 53 f2 2e 3f 8a b3 |.TS..?.. |
+key expansion[104]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.|
+| f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.|
+| 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.|
+| 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..|
+| 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......|
+| c3 54 53 f2 2e 3f 8a b3 |.TS..?.. |
+Client MAC key[20]:
+| 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.|
+| 9a 61 bf 0c |.a.. |
+Server MAC key[20]:
+| 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 f6 8c 6f ac |0Vw.oE...hU...o.|
+| bb 31 1d ae |.1.. |
+Client Write key[16]:
+| 61 55 5f 74 03 d5 63 a8 46 6d a4 e6 d6 d8 5b d3 |aU_t..c.Fm....[.|
+Server Write key[16]:
+| c0 2e a3 39 81 2f 37 d2 20 72 ef 96 af db 8c dd |...9./7. r......|
+Client Write IV[16]:
+| f4 ca 3d 05 f8 3a 14 9c 4c 39 48 58 05 af c1 c1 |..=..:..L9HX....|
+Server Write IV[16]:
+| 2a 9e bb 97 ee 8c 85 ad c3 54 53 f2 2e 3f 8a b3 |*........TS..?..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..|
+| 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....|
+| 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 39 62 cb 33 71 c3 fd ae 15 ae 5c 2c e8 ca d3 02 |9b.3q.....\,....|
+| 57 0f 8b df e0 42 e8 cd 70 58 5a ef ee d1 06 2d |W....B..pXZ....-|
+| 8b cd c9 07 cd c7 a6 39 a5 6c b4 e9 70 24 18 26 |.......9.l..p$.&|
+| ea 8d a0 39 d7 30 82 bc e2 db e1 db 94 da 97 80 |...9.0..........|
+Plaintext[64]:
+| 50 1f 07 fa 0d 0b 39 a0 0a 64 7e 64 e9 3b aa 4c |P.....9..d~d.;.L|
+| 14 00 00 0c 12 9d d4 f8 27 09 99 d2 72 a8 cf 85 |........'...r...|
+| 3e 05 25 db bf 0c 15 aa 2a 40 95 31 9c ac 60 e3 |>.%.....*@.1..`.|
+| 12 34 55 3c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.4U<............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e 05 25 db bf 0c 15 aa 2a 40 95 31 9c ac 60 e3 |>.%.....*@.1..`.|
+| 12 34 55 3c |.4U< |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #564 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 9a 82 e6 8c aa 36 3d 97 51 bd 1e 2d 4b f8 c0 1c |.....6=.Q..-K...|
+| 1f 60 86 a2 f9 d7 64 f4 3a 25 34 37 6d 7c df 4b |.`....d.:%47m|.K|
+| 7c c8 15 01 cd 92 ab fe 59 f6 89 a5 6b 7d 50 e5 ||.......Y...k}P.|
+| cb d7 d5 67 98 10 29 65 d5 f1 e4 ec 25 2b 19 0e |...g..)e....%+..|
+Plaintext[64]:
+| 61 a9 fb c3 d4 5c 11 af 0a 1e 47 f0 12 6a b7 04 |a....\....G..j..|
+| 14 00 00 0c 3a ce 0c 81 41 3f 76 af 1a 98 59 48 |....:...A?v...YH|
+| db 3b f3 3c 74 82 bc 2f f9 94 48 87 11 14 c7 83 |.;.<t../..H.....|
+| 41 f0 15 95 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |A...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| db 3b f3 3c 74 82 bc 2f f9 94 48 87 11 14 c7 83 |.;.<t../..H.....|
+| 41 f0 15 95 |A... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #565 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 11 c7 19 72 8d af cc dc e1 a9 e8 d0 89 e0 e6 5b |...r...........[|
+| 65 00 22 1a 1f 47 ae 51 7e 0c 9e cb 18 26 08 fe |e."..G.Q~....&..|
+| ff d1 b4 48 a5 13 15 56 cd ab 0b b3 72 18 44 41 |...H...V....r.DA|
+| 00 84 a8 5c 84 01 88 35 a7 ed 98 2a f0 96 bc 58 |...\...5...*...X|
+| 36 91 78 5b 96 38 b5 f7 43 85 4a ce d4 32 89 e8 |6.x[.8..C.J..2..|
+| 07 48 c3 0e e8 c2 82 d4 b1 79 5e ff dd c9 3b 08 |.H.......y^...;.|
+| 29 2d 7a 85 a5 b1 3d 1b 3c da 65 92 cd 8c a9 e9 |)-z...=.<.e.....|
+Plaintext[112]:
+| c1 a5 4c 29 3c c1 9b 56 4d 73 25 2e 16 0b 1c 0f |..L)<..VMs%.....|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 33 0d 0a 0d 0a e9 dc ed 7b 35 3e |l:4493.......{5>|
+| 80 1d df 49 f7 b7 b9 b4 51 76 27 8b c1 32 01 01 |...I....Qv'..2..|
+ssl_decrypt_record found padding 1 final len 110
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a6 f1 8a eb 0c b2 be 05 01 61 51 20 07 fb d6 e5 |.........aQ ....|
+| 04 b9 f4 43 |...C |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55294 found (nil)
+association_find: TCP port 4493 found 0x3431960
+
+dissect_ssl enter frame #566 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 0c 1a ed 62 67 7c d3 bf 24 2c b8 62 2e 87 c9 14 |...bg|..$,.b....|
+| 11 d7 0d a5 a4 06 0a 81 41 4d d8 8b 1b 32 f5 df |........AM...2..|
+| 5d 96 be 73 c1 44 c0 9e da c5 00 f5 7a 40 d7 9e |]..s.D......z@..|
+| f4 e0 e6 94 59 a2 2f 9c 17 80 53 aa 47 e0 ed bc |....Y./...S.G...|
+| c8 19 69 ac 89 b8 7f 76 de a9 15 f4 e2 ec f0 18 |..i....v........|
+| e8 75 d1 1d d6 78 90 4a 5b 0a 90 55 b1 ac ce 01 |.u...x.J[..U....|
+| 63 a2 b2 ec 72 f3 cc 2a b0 a2 86 14 20 27 6c 6d |c...r..*.... 'lm|
+| d3 8a 2b 20 92 6e a4 f8 0d 3d e9 74 2f b3 ca d4 |..+ .n...=.t/...|
+| 12 c9 58 99 dc 48 46 3e a7 2a d8 09 2e be 25 e8 |..X..HF>.*....%.|
+| ae 8d ad a7 8b 54 b9 2f 3e c8 29 19 6c 91 e9 25 |.....T./>.).l..%|
+| d9 95 43 9f 12 66 15 88 11 c9 93 fa bf c2 0e fa |..C..f..........|
+| 8a b4 d1 41 7f 77 17 da 3b a0 fe c0 f2 9e 8b 90 |...A.w..;.......|
+| be 3c c8 92 07 87 1c 3e fb 4f c0 07 be 04 22 35 |.<.....>.O...."5|
+| 63 a5 e4 9e 2b f5 d7 d8 de 0e e2 f0 c2 6b 25 e4 |c...+........k%.|
+| 73 87 41 f1 26 96 3d 09 e9 0d 27 89 4a a3 ec e9 |s.A.&.=...'.J...|
+| c2 75 94 35 bb 6b 59 37 6b b9 30 f8 91 c5 e4 fc |.u.5.kY7k.0.....|
+| 3e 90 8b 16 d9 96 7d cc f8 c2 ef a6 d4 86 86 d0 |>.....}.........|
+| 12 b0 9a 4f 46 d7 73 7d 40 ff 65 c9 37 e6 f0 a3 |...OF.s}@.e.7...|
+| 62 66 ab 6d 54 8a a9 a0 26 b4 cf 22 a3 68 04 b2 |bf.mT...&..".h..|
+| c2 aa 01 5e d5 b0 32 78 9f 97 6b bb 82 8b 25 46 |...^..2x..k...%F|
+| 6b 7d 9c 5e d8 99 0f e7 07 a7 44 aa 6f 32 57 00 |k}.^......D.o2W.|
+| f6 a4 4c cc ea bc 33 96 94 d8 77 8c 8b f3 45 fa |..L...3...w...E.|
+| fc 4a f2 2c 75 05 c2 55 25 3a 1b 7b 3b aa e0 1b |.J.,u..U%:.{;...|
+| 8f d7 5e 91 1c da 0f 25 6d 05 8d b3 cf e1 54 e1 |..^....%m.....T.|
+| 68 0f 5e 1d b1 18 c5 47 44 b1 e2 24 53 c9 d5 04 |h.^....GD..$S...|
+Plaintext[400]:
+| 7d 51 f2 64 a1 0c f4 c8 11 5a 58 94 04 fa d4 a3 |}Q.d.....ZX.....|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 12 90 f4 48 |nl'</script>...H|
+| 96 c2 91 2e c1 9d ad 32 d6 bd 70 12 c7 13 00 7f |.......2..p.....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 71 53 c7 1f 72 64 3d ba a1 32 da 30 ba 36 07 de |qS..rd=..2.0.6..|
+| bf 85 bc e3 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4493 found 0x3431960
+
+dissect_ssl enter frame #567 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| dc cf 24 89 c6 0c 56 f9 f2 db af b4 d0 27 67 4c |..$...V......'gL|
+| c5 14 8a ab 4f bc 57 ba 76 ed fe 60 99 de cf 92 |....O.W.v..`....|
+| 82 4f a6 6d 19 57 c9 e8 80 a5 9d 43 a2 9c 27 b4 |.O.m.W.....C..'.|
+Plaintext[48]:
+| 70 49 5b ce d8 7a ce e0 09 b9 ab e7 a3 a2 ad bc |pI[..z..........|
+| 01 00 ad c1 c2 b0 a8 7e fb 3c ac 92 ca 7d 2a a7 |.......~.<...}*.|
+| f6 15 8e 50 42 ad 09 09 09 09 09 09 09 09 09 09 |...PB...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ad c1 c2 b0 a8 7e fb 3c ac 92 ca 7d 2a a7 f6 15 |.....~.<...}*...|
+| 8e 50 42 ad |.PB. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #569 (first time)
+ conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 02 e1 53 d6 bb 96 1f 4a e4 be 8d 0c 23 7b c0 9b |..S....J....#{..|
+| 35 c1 91 f9 0d 31 5c f0 0d 48 f2 ac f4 b4 4a 8a |5....1\..H....J.|
+| dc 2a 6b 8c 83 4d 85 bf 08 ab a4 ba 5b bd f2 49 |.*k..M......[..I|
+Plaintext[48]:
+| 16 a5 5d ba 7f 87 ad ca a4 c1 f6 5e 95 e5 db 76 |..]........^...v|
+| 01 00 c1 02 59 a4 a3 ee 13 07 27 f1 71 cc fa 01 |....Y.....'.q...|
+| d7 ba fc ff 77 d7 09 09 09 09 09 09 09 09 09 09 |....w...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c1 02 59 a4 a3 ee 13 07 27 f1 71 cc fa 01 d7 ba |..Y.....'.q.....|
+| fc ff 77 d7 |..w. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #574 (first time)
+ssl_session_init: initializing ptr 0x7facc38686e0 size 688
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 41513 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4494
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #576 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 1230
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 66, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..|
+| 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....|
+| 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 6e 08 25 c8 74 53 58 ef 2c 57 1c be 4f ab 12 |'n.%.tSX.,W..O..|
+| 69 d0 ff 82 05 d1 7d 42 c7 c0 f3 3a c0 52 34 bf |i.....}B...:.R4.|
+| 27 1b 22 ce ab 55 97 4c 25 6d b5 76 91 27 09 ca |'."..U.L%m.v.'..|
+| 19 5a b5 77 8d b5 2b 06 2f 85 5f 08 05 |.Z.w..+./._.. |
+hash out[136]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....|
+| 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.|
+| 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.|
+| ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....|
+| a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X|
+| ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../|
+| 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_|
+| 4d 4d 61 91 1d 30 3e f9 |MMa..0>. |
+PRF out[136]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....|
+| 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.|
+| 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.|
+| ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....|
+| a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X|
+| ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../|
+| 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_|
+| 4d 4d 61 91 1d 30 3e f9 |MMa..0>. |
+key expansion[136]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....|
+| 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.|
+| 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.|
+| ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....|
+| a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X|
+| ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../|
+| 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_|
+| 4d 4d 61 91 1d 30 3e f9 |MMa..0>. |
+Client MAC key[20]:
+| d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..|
+| ff c8 fb 3e |...> |
+Server MAC key[20]:
+| 8c bb cc 54 cc db cc 63 b7 e2 14 fe 2c b3 9b d0 |...T...c....,...|
+| 52 c8 38 1c |R.8. |
+Client Write key[32]:
+| 4a c3 ef 9f 0f 1b 58 bf 50 24 98 f3 73 84 91 7a |J.....X.P$..s..z|
+| 7c 77 1c b8 00 ae 66 fb ef 14 46 f2 15 2c e6 7a ||w....f...F..,.z|
+Server Write key[32]:
+| 0c a2 81 6d c8 e2 bb ed a6 d8 0b 48 7b 1e bc 81 |...m.......H{...|
+| 16 b1 ce b7 d2 79 ee 58 ee 74 bb fb 2b 6a b9 97 |.....y.X.t..+j..|
+Client Write IV[16]:
+| 92 52 a9 9e 18 bf 8e 2f 19 45 20 49 eb e2 e6 8b |.R...../.E I....|
+Server Write IV[16]:
+| 29 9c d3 cb 1e d8 f2 5f 4d 4d 61 91 1d 30 3e f9 |)......_MMa..0>.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 71, reported_length_remaining = 1159
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883
+ record: offset = 883, reported_length_remaining = 347
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 333, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221
+ record: offset = 1221, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230
+
+dissect_ssl enter frame #578 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 150
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778d...
+looking for RSA pre-master41046cd693c8d494ffed8f2f2cc05fcaf360a4732284d113...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf272587db66ce4fafb1e84f7da8a966d54214310f644ecfecd218387eb1 F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778db52b062f855f0805 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3d db 56 9f 9b 91 f2 53 31 b2 b8 c7 96 10 c0 b5 |=.V....S1.......|
+| 90 75 1a 69 69 40 66 61 dd 50 90 dc 83 1b 5f e6 |.u.ii@fa.P...._.|
+| 92 18 11 12 8f 1b c2 6c d9 6b 29 49 72 4b c6 03 |.......l.k)IrK..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 27 6e 08 25 c8 74 53 58 ef 2c 57 1c be 4f ab 12 |'n.%.tSX.,W..O..|
+| 69 d0 ff 82 05 d1 7d 42 c7 c0 f3 3a c0 52 34 bf |i.....}B...:.R4.|
+| 27 1b 22 ce ab 55 97 4c 25 6d b5 76 91 27 09 ca |'."..U.L%m.v.'..|
+| 19 5a b5 77 8d b5 2b 06 2f 85 5f 08 05 |.Z.w..+./._.. |
+hash out[136]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS|
+| f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.|
+| d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...|
+| 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<|
+| 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.|
+| ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r|
+| b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.|
+| 53 95 86 05 01 d7 72 3c |S.....r< |
+PRF out[136]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS|
+| f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.|
+| d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...|
+| 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<|
+| 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.|
+| ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r|
+| b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.|
+| 53 95 86 05 01 d7 72 3c |S.....r< |
+key expansion[136]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS|
+| f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.|
+| d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...|
+| 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<|
+| 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.|
+| ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r|
+| b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.|
+| 53 95 86 05 01 d7 72 3c |S.....r< |
+Client MAC key[20]:
+| 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...|
+| 89 13 7c f5 |..|. |
+Server MAC key[20]:
+| 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 f0 4f c4 28 |..".......PS.O.(|
+| 58 d1 58 43 |X.XC |
+Client Write key[32]:
+| de e7 18 9c be 1c 31 bf d1 1b a1 81 f5 cb 0b 15 |......1.........|
+| 84 df cf b9 46 11 cb ca 50 90 70 e9 9e cc bd 8e |....F...P.p.....|
+Server Write key[32]:
+| bb 42 3a 51 10 6e 7a 3c 2f d2 d6 bc 99 00 e1 3e |.B:Q.nz</......>|
+| fc 4f 6e f4 33 12 55 ac ce 9e b4 01 85 6c d8 f9 |.On.3.U......l..|
+Client Write IV[16]:
+| 59 3b ae 12 2b c8 3f 72 b4 c1 47 2a f0 05 ed 57 |Y;..+.?r..G*...W|
+Server Write IV[16]:
+| f2 6a 76 10 19 17 3a eb 53 95 86 05 01 d7 72 3c |.jv...:.S.....r<|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3d db 56 9f 9b 91 f2 53 31 b2 b8 c7 96 10 c0 b5 |=.V....S1.......|
+| 90 75 1a 69 69 40 66 61 dd 50 90 dc 83 1b 5f e6 |.u.ii@fa.P...._.|
+| 92 18 11 12 8f 1b c2 6c d9 6b 29 49 72 4b c6 03 |.......l.k)IrK..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b2 e5 ce a9 70 28 1f c8 ff f9 56 00 45 39 6f 6d |....p(....V.E9om|
+| 26 86 a8 8d 5e 07 99 e0 03 8a 8a 46 c9 a0 82 9f |&...^......F....|
+| 09 a3 48 3a d9 9c 22 19 a3 e9 0a 0d 15 1c 0a a3 |..H:..".........|
+| 95 78 94 83 67 93 8c da 1b 7b 93 55 7b b8 d4 d4 |.x..g....{.U{...|
+Plaintext[64]:
+| b6 87 6e bc 4b 76 09 de a7 71 2a d5 eb 57 58 ff |..n.Kv...q*..WX.|
+| 14 00 00 0c d4 31 1c 85 5d dc 59 d9 c7 1a c8 34 |.....1..].Y....4|
+| 0a 7d 21 5e b2 68 a9 40 d7 78 bd 52 13 7b 48 e4 |.}!^.h.@.x.R.{H.|
+| ce 1f a1 f4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0a 7d 21 5e b2 68 a9 40 d7 78 bd 52 13 7b 48 e4 |.}!^.h.@.x.R.{H.|
+| ce 1f a1 f4 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #579 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 2a 19 9a 9d 49 71 4a cb a6 84 97 ca 5a ff e2 d8 |*...IqJ.....Z...|
+| f9 42 ec 97 55 20 1f 54 ad e2 9d 06 5f 73 13 dc |.B..U .T...._s..|
+| 0e bc ad 1e e9 cf 4c 12 24 36 29 03 c0 b4 31 5b |......L.$6)...1[|
+| f5 7f db 78 22 2a bf f5 69 2b c4 fd a3 3f 6d 70 |...x"*..i+...?mp|
+Plaintext[64]:
+| d1 dd 68 ce 8d 2c 35 58 b0 8c df 31 fa 7e 9d 26 |..h..,5X...1.~.&|
+| 14 00 00 0c 79 c4 59 e5 00 cd 78 e3 60 c0 60 7d |....y.Y...x.`.`}|
+| b9 cc 76 a2 70 1c da 74 62 dc 98 1a e1 7b 9d 35 |..v.p..tb....{.5|
+| 3f 70 ae ec 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |?p..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b9 cc 76 a2 70 1c da 74 62 dc 98 1a e1 7b 9d 35 |..v.p..tb....{.5|
+| 3f 70 ae ec |?p.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #580 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| ca 7a 92 64 b4 c9 aa 19 0f 19 3e 97 70 aa 0b ed |.z.d......>.p...|
+| c0 2e 63 bc 3d 91 ef 86 1c 6b 80 3c 98 d2 41 03 |..c.=....k.<..A.|
+| db 04 c1 c3 eb 7f 90 0f d3 1f b2 e6 8b bc f3 d7 |................|
+| a0 3a 04 d4 8b f5 3b 01 aa 5d 46 08 3d fb 8f e0 |.:....;..]F.=...|
+| ae 47 9b fc cb 8e f8 7e cd 29 10 37 f3 49 bb a1 |.G.....~.).7.I..|
+| c0 2f 2b a6 69 3d 45 e1 b6 2d fa 62 92 5d 60 01 |./+.i=E..-.b.]`.|
+| 11 3d b8 d5 d4 a4 e1 57 37 96 4c a1 ad bf 02 60 |.=.....W7.L....`|
+Plaintext[112]:
+| 2c 40 d8 2c 17 51 aa 1a 4b 96 ba 95 a7 38 60 17 |,@.,.Q..K....8`.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-|
+| 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 39 34 0d 0a 0d 0a af b4 b9 bc 7f e1 |l:4494..........|
+| dc 9a 51 8f c8 e5 87 7f 28 09 dd 18 cd ec 01 01 |..Q.....(.......|
+ssl_decrypt_record found padding 1 final len 110
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 90 e0 62 9f 41 4c 23 19 40 d8 84 6e 36 b7 4f |...b.AL#.@..n6.O|
+| 50 8e 40 af |P.@. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 41513 found (nil)
+association_find: TCP port 4494 found 0x34319f0
+
+dissect_ssl enter frame #581 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| b8 da 63 57 52 36 26 1b 47 d0 de 68 e8 b6 6c 04 |..cWR6&.G..h..l.|
+| b8 06 e8 50 28 94 5d fb b8 f4 4a 72 08 51 58 38 |...P(.]...Jr.QX8|
+| 37 1c ec 44 c2 ef 68 78 cf 1d e9 d2 d7 48 4c 79 |7..D..hx.....HLy|
+| ba d7 ee 04 4e 50 0b 24 ca b8 23 25 93 e4 bc b4 |....NP.$..#%....|
+| 8e 55 a4 39 eb e7 69 87 57 96 75 b9 de f7 52 ba |.U.9..i.W.u...R.|
+| 45 0c db 52 e0 99 44 e4 38 a9 ca 87 90 b3 1b e3 |E..R..D.8.......|
+| 45 96 79 a4 e0 b9 0a 8f ae dc 09 ed 8e 53 50 cf |E.y..........SP.|
+| c4 e2 80 57 c6 c2 44 69 5b 65 0b e9 e6 ca 02 e7 |...W..Di[e......|
+| 1f f1 42 e4 f3 19 03 2b 4f ee 24 f2 44 aa 4c 19 |..B....+O.$.D.L.|
+| 8b fd fa ed db c0 b3 af 8f 27 c8 9d a8 54 b0 19 |.........'...T..|
+| ea 94 35 d2 68 b9 90 a3 8f d5 a8 bc 9f 2b b8 4a |..5.h........+.J|
+| c3 40 c0 3b c5 aa de aa e3 11 9f d6 17 95 2a 48 |.@.;..........*H|
+| 9c 18 14 2c 4e e0 5a 0b 26 5f a5 88 d9 46 0f ef |...,N.Z.&_...F..|
+| 51 ac 5f 74 0e 63 e6 be c1 eb 95 44 c4 d2 d2 ca |Q._t.c.....D....|
+| 51 3d 27 f6 20 ef 8b 5d e5 d0 56 a4 4a 31 12 a8 |Q='. ..]..V.J1..|
+| db 94 c5 ea b1 9c 9e b4 5d f4 ef 3e b0 24 a8 0c |........]..>.$..|
+| 95 9d 51 79 87 b3 74 5e 06 ee 8a 87 87 0f 64 17 |..Qy..t^......d.|
+| f9 7b 8d df a4 0a e7 0a 07 4e d7 ce 74 df 3a 38 |.{.......N..t.:8|
+| a1 51 e3 94 ff b2 63 e0 66 ef 82 7d 87 30 46 3a |.Q....c.f..}.0F:|
+| e7 5e e9 0a fa 93 ff ae 1d f6 45 09 c6 23 06 ca |.^........E..#..|
+| 73 12 a2 6c ad c6 94 99 29 c4 cd 15 f8 6c b7 db |s..l....)....l..|
+| 87 e6 ff 07 57 55 72 9e 5d 5a db 8e 94 f6 0e 06 |....WUr.]Z......|
+| 71 9f c7 44 92 49 aa 3d 8f bc c0 e1 2a 64 2d 0b |q..D.I.=....*d-.|
+| a8 9d e8 48 1e 2e 42 36 b6 a7 74 97 2d b1 3a b5 |...H..B6..t.-.:.|
+| cf fe 5b e6 7d 72 2e 22 d5 16 25 a0 e1 2e 0e f8 |..[.}r."..%.....|
+Plaintext[400]:
+| 9c 23 65 2a 6e 85 5d b9 46 3c 12 21 7d 6e 19 2c |.#e*n.].F<.!}n.,|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:19 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE|
+| 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH|
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 58 66 96 84 |nl'</script>Xf..|
+| d9 73 c8 a3 eb 8b 98 83 a7 72 69 2d 1f e2 11 26 |.s.......ri-...&|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6a 86 7d 10 91 da 1f 86 1f 43 33 e2 2a 04 1b f4 |j.}......C3.*...|
+| fe af 57 14 |..W. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4494 found 0x34319f0
+
+dissect_ssl enter frame #582 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 0d 9f 7c 74 f8 87 71 8e 5e 38 9a 57 a1 5b 60 41 |..|t..q.^8.W.[`A|
+| 6b ed d6 f2 79 d0 70 05 aa cc 1e 64 ef df 5a e1 |k...y.p....d..Z.|
+| c0 c6 55 70 67 03 c5 15 28 69 da 7f 25 32 1f b8 |..Upg...(i..%2..|
+Plaintext[48]:
+| 1d 5a e8 74 d0 2b 86 61 e7 5f 0e 98 f2 32 7e b2 |.Z.t.+.a._...2~.|
+| 01 00 b1 97 4c 4b 89 1e c1 dd ce e1 52 86 9e 65 |....LK......R..e|
+| fb 50 9f 1a cb 62 09 09 09 09 09 09 09 09 09 09 |.P...b..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b1 97 4c 4b 89 1e c1 dd ce e1 52 86 9e 65 fb 50 |..LK......R..e.P|
+| 9f 1a cb 62 |...b |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #584 (first time)
+ conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| ff 13 52 38 01 4f 68 66 3c 33 42 cf 61 f0 65 5e |..R8.Ohf<3B.a.e^|
+| 6e a5 b3 0b e5 01 d3 66 b0 ef e0 3e 5a da 8e 8c |n......f...>Z...|
+| d5 19 c6 95 eb 2f 15 1e 5d aa 0b 72 4f 96 a4 a3 |...../..]..rO...|
+Plaintext[48]:
+| 42 5e 49 b1 26 1f 4f a1 0e 6e 12 8b 1c 74 64 f6 |B^I.&.O..n...td.|
+| 01 00 80 22 ef 86 b1 fa 0b 63 8e bf 56 65 22 c9 |...".....c..Ve".|
+| 25 c3 1e 5e 60 df 09 09 09 09 09 09 09 09 09 09 |%..^`...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 80 22 ef 86 b1 fa 0b 63 8e bf 56 65 22 c9 25 c3 |.".....c..Ve".%.|
+| 1e 5e 60 df |.^`. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #4 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+
+dissect_ssl enter frame #6 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #128 (already visited)
+ conversation = 0x7facef9977c0, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 40165 found (nil)
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #11 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #12 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+
+dissect_ssl enter frame #14 (already visited)
+ conversation = 0x7facef996088, ssl_session = (nil)
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
diff --git a/tls/all/dump.pcapng b/tls/all/dump.pcapng
new file mode 100644
index 0000000..f3cb271
--- /dev/null
+++ b/tls/all/dump.pcapng
Binary files differ
diff --git a/tls/all/premaster.txt b/tls/all/premaster.txt
new file mode 100644
index 0000000..c904d3f
--- /dev/null
+++ b/tls/all/premaster.txt
@@ -0,0 +1,78 @@
+CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384
+CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2
+CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2
+CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045
+CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320
+CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259
+CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2
+CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D
+CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19
+CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF
+CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E
+CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+CLIENT_RANDOM 5234bf272587db66ce4fafb1e84f7da8a966d54214310f644ecfecd218387eb1 F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054
+CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778db52b062f855f0805 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603
+CLIENT_RANDOM 5234bf276e0825c8745358ef2c571cbe4fab1269d0ff8205d17d42c7c0f33ac0 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603
diff --git a/tls/all/tls-urls.txt b/tls/all/tls-urls.txt
new file mode 100644
index 0000000..0e1702f
--- /dev/null
+++ b/tls/all/tls-urls.txt
@@ -0,0 +1,39 @@
+https://exp-rc4-md5.local.al.lekensteyn.nl:4434
+https://rc4-md5.local.al.lekensteyn.nl:4435
+https://rc4-sha.local.al.lekensteyn.nl:4436
+https://exp-rc2-cbc-md5.local.al.lekensteyn.nl:4437
+https://idea-cbc-sha.local.al.lekensteyn.nl:4438
+https://exp-des-cbc-sha.local.al.lekensteyn.nl:4439
+https://des-cbc-sha.local.al.lekensteyn.nl:4440
+https://des-cbc3-sha.local.al.lekensteyn.nl:4441
+https://edh-dss-des-cbc-sha.local.al.lekensteyn.nl:4443
+https://edh-dss-des-cbc3-sha.local.al.lekensteyn.nl:4444
+https://edh-rsa-des-cbc-sha.local.al.lekensteyn.nl:4446
+https://edh-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4447
+https://aes128-sha.local.al.lekensteyn.nl:4448
+https://dhe-dss-aes128-sha.local.al.lekensteyn.nl:4449
+https://dhe-rsa-aes128-sha.local.al.lekensteyn.nl:4450
+https://aes256-sha.local.al.lekensteyn.nl:4451
+https://dhe-dss-aes256-sha.local.al.lekensteyn.nl:4452
+https://dhe-rsa-aes256-sha.local.al.lekensteyn.nl:4453
+https://camellia128-sha.local.al.lekensteyn.nl:4457
+https://dhe-dss-camellia128-sha.local.al.lekensteyn.nl:4458
+https://dhe-rsa-camellia128-sha.local.al.lekensteyn.nl:4459
+https://camellia256-sha.local.al.lekensteyn.nl:4463
+https://dhe-dss-camellia256-sha.local.al.lekensteyn.nl:4464
+https://dhe-rsa-camellia256-sha.local.al.lekensteyn.nl:4465
+https://seed-sha.local.al.lekensteyn.nl:4470
+https://dhe-dss-seed-sha.local.al.lekensteyn.nl:4471
+https://dhe-rsa-seed-sha.local.al.lekensteyn.nl:4472
+https://ecdh-ecdsa-rc4-sha.local.al.lekensteyn.nl:4479
+https://ecdh-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4480
+https://ecdh-ecdsa-aes128-sha.local.al.lekensteyn.nl:4481
+https://ecdh-ecdsa-aes256-sha.local.al.lekensteyn.nl:4482
+https://ecdhe-ecdsa-rc4-sha.local.al.lekensteyn.nl:4483
+https://ecdhe-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4484
+https://ecdhe-ecdsa-aes128-sha.local.al.lekensteyn.nl:4485
+https://ecdhe-ecdsa-aes256-sha.local.al.lekensteyn.nl:4486
+https://ecdhe-rsa-rc4-sha.local.al.lekensteyn.nl:4491
+https://ecdhe-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4492
+https://ecdhe-rsa-aes128-sha.local.al.lekensteyn.nl:4493
+https://ecdhe-rsa-aes256-sha.local.al.lekensteyn.nl:4494
diff --git a/tls/all/wireshark-broken.txt b/tls/all/wireshark-broken.txt
new file mode 100644
index 0000000..51a4904
--- /dev/null
+++ b/tls/all/wireshark-broken.txt
@@ -0,0 +1,33 @@
+https://exp-rc2-cbc-md5.local.al.lekensteyn.nl:4437
+https://idea-cbc-sha.local.al.lekensteyn.nl:4438
+https://exp-des-cbc-sha.local.al.lekensteyn.nl:4439
+https://des-cbc-sha.local.al.lekensteyn.nl:4440
+https://des-cbc3-sha.local.al.lekensteyn.nl:4441
+https://edh-dss-des-cbc-sha.local.al.lekensteyn.nl:4443
+https://edh-dss-des-cbc3-sha.local.al.lekensteyn.nl:4444
+https://edh-rsa-des-cbc-sha.local.al.lekensteyn.nl:4446
+https://edh-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4447
+https://aes128-sha.local.al.lekensteyn.nl:4448
+https://dhe-dss-aes128-sha.local.al.lekensteyn.nl:4449
+https://dhe-rsa-aes128-sha.local.al.lekensteyn.nl:4450
+https://aes256-sha.local.al.lekensteyn.nl:4451
+https://dhe-dss-aes256-sha.local.al.lekensteyn.nl:4452
+https://dhe-rsa-aes256-sha.local.al.lekensteyn.nl:4453
+https://camellia128-sha.local.al.lekensteyn.nl:4457
+https://dhe-dss-camellia128-sha.local.al.lekensteyn.nl:4458
+https://dhe-rsa-camellia128-sha.local.al.lekensteyn.nl:4459
+https://camellia256-sha.local.al.lekensteyn.nl:4463
+https://dhe-dss-camellia256-sha.local.al.lekensteyn.nl:4464
+https://dhe-rsa-camellia256-sha.local.al.lekensteyn.nl:4465
+https://seed-sha.local.al.lekensteyn.nl:4470
+https://dhe-dss-seed-sha.local.al.lekensteyn.nl:4471
+https://dhe-rsa-seed-sha.local.al.lekensteyn.nl:4472
+https://ecdh-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4480
+https://ecdh-ecdsa-aes128-sha.local.al.lekensteyn.nl:4481
+https://ecdh-ecdsa-aes256-sha.local.al.lekensteyn.nl:4482
+https://ecdhe-ecdsa-des-cbc3-sha.local.al.lekensteyn.nl:4484
+https://ecdhe-ecdsa-aes128-sha.local.al.lekensteyn.nl:4485
+https://ecdhe-ecdsa-aes256-sha.local.al.lekensteyn.nl:4486
+https://ecdhe-rsa-des-cbc3-sha.local.al.lekensteyn.nl:4492
+https://ecdhe-rsa-aes128-sha.local.al.lekensteyn.nl:4493
+https://ecdhe-rsa-aes256-sha.local.al.lekensteyn.nl:4494
diff --git a/tls/all/wireshark-works.txt b/tls/all/wireshark-works.txt
new file mode 100644
index 0000000..1a04450
--- /dev/null
+++ b/tls/all/wireshark-works.txt
@@ -0,0 +1,6 @@
+https://exp-rc4-md5.local.al.lekensteyn.nl:4434
+https://rc4-md5.local.al.lekensteyn.nl:4435
+https://rc4-sha.local.al.lekensteyn.nl:4436
+https://ecdh-ecdsa-rc4-sha.local.al.lekensteyn.nl:4479
+https://ecdhe-ecdsa-rc4-sha.local.al.lekensteyn.nl:4483
+https://ecdhe-rsa-rc4-sha.local.al.lekensteyn.nl:4491