ioe eee Ble edt view co Capure analyze Statetrcs Heb GBHAAGe OA« eS Be SSFIL SS QQQHRAHKGD ~ Bepressien.. Clear érply Destination 65 3.252380 195.149.208.216 a Frame 64 C132 bytes on wire, 132 bytes captured) la Ethernet II, Src: 138.100.10.122 (OO:40:f4:b0:f2:d3), Dst: 138.100.8.125 COO:04:dd:70:65:42) la Internet Protocol, Src: 138.100.10.122 (138.100.10.122), Ost: 195.149.208.216 (195.149, 208. 216) la Transmission Control Protocol, Src Port: 2677 (2677), Dst Port: https (443), Seq: 1, Ack: 1, Len: 78 3 Secure Socket Layer 3 SSLv2 Record Layer: Client Hello Length: 76 Handshake Message Type: Client Hello CL) version: SSL 3.0 (0x0300) Cipher Spec Length: 51 Session ID Length: 0 Challenge Length: 16 BSE (=) Cipher Spec: TLS_RSA WITH RCA 128_ 605 Cipher Spec: TLS_RSA WITH RC4_128_SHA COx0000059 Cipher Spec: TLS_RSA WITH 3DES_EDE_CEC_SHA (Dx00000a) Cipher Spec: SSL2_RC4_128_WETH_WDS (Ox010080) Cipher Spec: SS(2_peS_192_FDe3_CRC_WITH_MDS (Ox0700c0) Cipher Spec: SSL2_RC2_CRC_128_CBC_WITH_ND5 (0x030080) Cipher Spec: TLS_ASA_WITH_DES_C@C SHA COx00d0099 Cipher Spec: SSL2_DES_64_CBC_WITH_MD5 COxg60D409 Cipher Spec: TLS_RSAEXPORTLO24_WETH_RC4_56_SHA (0x000064) Cipher Spec: TLS_RSA ExPORTIO24 WITH_DES_CBC_SHA (Dx000062) Cipher Spec: TLS_RSA EXPORT WITH_RC4_40_MD5 COx000003) Cipher Spec: TLS_RSA EXPORT WITH RC2_CBC_40_ND5_(0x000008) Cipher Spec: SSL2_RC4_128_EXPORT4O_METH_MDS COx020080) Cipher Spec: SSL2_RC2_CBC_128_CBC_WITH_NDS (Ox040080) Cipher Spec: TLS_PHE_PSS_WITH_3065_EDE_cBc_sHA (0xD00013) Cipher Spec: TLS_DHE_DSS_WITH_DES_C&C_SHA COxDO0012> Cipher Spec: TLS_DHE_DSS_EXPCRTLOZ4_WITH_DES_CBC_SHA €0x000063) chaMenge ae 3/7 51 83 BB 70 55 7h 24 Do Is 34 TotoFcpher sutes s.ppored oy cient [Free Dr a86 MEDCima eaice Ble edt view co Capure analyze Statetrcs Heb GHAGe O« eS Be SFI SS QQQAHRAHKG Fite ~ Erpresein. Clear aepiy Nee Tire source Destination Frotzcel info al 352380 208.216 138.100.10.122 Top https > 2677 [Ack] Seqei acka79 win=24820 Len=D 354927, _208-216 138.100 Tiep coment of a reassembled POU] 10,122 comes 7 Tate. Server 68 3.395203 Dog.10.122 199,149, 208,216 ST Se eee 69 31356366 138.100'10.122 1951140208/216 — S5Lv3_ Client Key Exchange, Change Cipher Spec, encrypted Handshake 7A 2 ANN Tas 1a 9Ne IIA TRAN IA 197 Teo hrtne 3 R77? Tare) SonaI7dd Ack—IRE Wine7ARIN | an fa Frame 67 (1337 bytes on wire, 1337 bytes captured) la Ethernet II, Src: 138.100.8.125 (00:04:dd:70:65:42), Dst: 138.100.10.122 (00:40: 4:b0:f2:d3) la Internet Protocol, Src: 195.149.208.216 (195.149.208.216), Ost: 138.100.10.122 (138.100. 10.122) [a Transmission Control Protocol, Src Port: https (443), Dst Port: 2677 (2677), Seq: 1461, Ack: 79, Len: 1283 ss [Reassembled TCP Segments (2743 bytes): #66(1460), #87(1283)] Is Secure Socket Layer SSSLv3 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) version: SSL 3.0 (0x0300) Length: 2738 Version: SSL 3.0 (0x0300) Random. gmt_unix_time: Jan 1, 1970 07:36:58. 000000000 Random. bytes session 1D Length: 22 Session 1 (32_bytes) Cipher Suite: TLS_RSA WITH_RCA128_ND5 Cox00D4> Compression Method: nul] Co) Handshake Protocol: Certificate Handshake Protocol: Server Hello bone Frame (397 bys) Roatsombled TOF C278 bts) angshake promco| ressage Gsihard [P1486 0: 486 NE Z@ captura_sslt - Ethereal Ble edt view co Capure analyze Statetrcs Heb GPHAAGe OB eS Ber VFL SPS QQQH MARKS Saree SST ho. Time ‘Source Destination Protzcol Info isl 352380 208.216 138.100.10.122 Top) https > 2677 [ACK] Seq=i Ack=79 win-24820 Len=0 2354927 _208-216 138.100 [ice segment of a reassenbied POUL 10,122 3.355203 Dog.10.122 199,149, 208,216 ST Se eee 6931356366 132.100.10.122 195.1491 20R.216 — ssLv3_ Client Key Exchange, Change cipher Spec, Encrypted Handshake Sha aRnGND Tas 140 INR IIR TAR ANNI 499 TeD.hetne SIRT? Tare Sona Pdd ark-7R® Wine IARI | an—N fa Frame 67 (1337 bytes on wire, 1337 bytes captured) la Ethernet II, Src: 138.100.8.125 (00:04:dd:70:65:42), Dst: 138.100.10.122 (00:40: 4:b0:f2:d3) la Internet Protocol, Src: 195.149.208.216 (195.149.208.216), Ost: 138.100.10.122 (138.100. 10.122) a Transmission Control Protocol, Src Port: https (443), Ost port: 2677 (2677), Seq: 1461, Ack: 73, Len: 1283 ss [Reassembled TCP Segments (2743 bytes): #66(1460), #87(1283)] Is Secure Socket Layer SSSLV3 Record Layer: Handshake Protocol: Multiple Handshake Messages content Type: Handshake (22) Length: 2/38 Handshake Protocol: Server Hello Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 2656 Certificates Length: 2653 aCertificates (653 bytes) Certificate Length: 1165 a Certificate: 308203F2400302010207106077F043D48DA00397E5 6ALFFE. Certificate Length: 903 a Certificate: 308202ECA00302010202102 54B5A853842CCE35BFBCIDOAE. . . Certificate Length: 576 @ Certificate: 3082014502107 08AE41 01009293486 38CA7BDICCBABF3OOD. . . = signedcertificate serialNumber ; Ox70bae41d10d92934b638ca7bO3ccbabF & signature = issuer: rdnsequence (0) & validity subject: rdiSequence (0) te sub jectPubickeyInfo algorithmidentitier Padding: 0 encrypted: 884C122RCF2C26004F141 30DABFBFCDAL1848CF 328106792 a as 010 82 el 1b 15 75 Oc fe 47 ca Fraine (1997 bytve) Roassombled TCP (274 byte) ecard yer vorsan, Gelreroraweree [Pom D: aa ND) ZCima eaice Ble edt view co Capure analyze Statetrcs Heb SHAGe «eS Bee OFF SS/QQQH MARK OB Fite ~ Erpresein. Clear aepiy Ne. Tire Source Destination Frotzcol info 352380 195.149.208.216 138.100.10.122 Top https > 2677 [ACK] Seq=i ack=79 win=24820 Len=D 354927 -209-216 138 -100-10.122 Tiep coment of a reassembled POU] i 5, cate. server Oo soso Se 1010-127 1g) 149-200-216 ST Se eee 69 31356366 138.100'10.122 1951140208/216 — S5Lv3_ Client Key Exchange, Change Cipher Spec, encrypted Handshake 7A 2 ANN Tas 1a 9Ne IIA TRAN IA 197 Teo hrtne 3 R77? Tare) SonaI7dd Ack—IRE Wine7ARIN | an fa Frame 67 (1337 bytes on wire, 1337 bytes captured) Ethernet II, Src: 138.100.8.125 (00:04:dd:70:65:42), Dst: 138.100.10.122 (00:40: f4:b0:f2:03) la Internet Protocol, Src: 195.149.208.216 (195.149.208.216), Ost: 138.100.10.122 (138.100. 10.122) a Transmission Control Protocol, Src Port: https (443), Ost port: 2677 (2677), Seq: 1461, Ack: 73, Len: 1283 ss [Reassembled TCP Segments (2743 bytes): #66(1460), #87(1283)] Secure Socket Layer SSSLv3 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) version: SSL 3.0 (0x0300) Length: 2738 Handshake Protocol: Server Hello a handshake Protocol: Certificate e a Handsnake Type? Length: 0 Server He abo 64 Od 64 da e Freire (1597 bytes) Roassombled TCP (274 byte) iansshake promco|rressage Gelnard [Pi 48 0: aa NE ZCima eaice Ble edt view co Capure analyze Statetrcs Heb GBHAAGe OA« eS Be SSFIL SS QQQHRAHKGD ~ Bepressien.. Clear érply Tire Source Destination Frotscal_|Infe 354927 208.216 138.100.10.122 top [TCP seoment of a reassembled PDU] 355066 208.216 138.100.10,122 SSL¥3 Server Hello, Certificate, Server Hello Done 355203 2 195.149.208.216 TCP 2677 > https’ [Ack] Seq=79 ack=2744 win=65535 Len=0 ons sp AS ance e Sa 350909 2208. 216 "100.10, 122 CNS > 2677 375036 208.216 100/10. 122 SSLv3_ Change Cipher Spec, Encrypted Handshake Message > fa Frame 69 (258 bytes on wire, 258 bytes captured) la Ethernet 11, Src: 138.100.10.122 (00:40:f4:b0:f2:d3), Dst: 138.100.8.125 (O0:04:dd:70:65:42) a Internet Protocol, Src: 138.100.10.122 (138.100.10.122), Dst: 195.149.208.216 (195.149.208.216 a Transmission Control Protocol, Src Port: 2677 (2677), Dst Port: https (443), Seq: 79, Ack: 2744, Len: ls Secure Socket Layer ESE! Content Type: Version: SSL 3.0 €x0300) Length: 132 Handshake Protocol: Client key Exchange Handshake Type: Client key Exchange (6) Length: 128 5 SSLV3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec Content Type: Change Cipher spec (20) Version: 55L 3.0 (0x0300) Length: 1) Change Cipher Spec Message 8 SSL¥3 Record Layer: Handshake Protocol: Encrypted Handshake Message Content Type: Handshake (22) Version: 55L 3.0 (0x0300) Length: 56 Handshake Protocol: Encrypted Handshake Message 204 ecard yer Gslrerord), 137 bytes [P45 0: 4a NO ZCima eaice Ble edt view co Capure analyze Statetrcs Heb PHeAe ox eS G++ PF2 OS QQQU B4MHXK ED ~ Bepressien.. Clear érply > Tire Source Destination Protical | Info 354927 208.216 138.100,10,122 Top [Tce segment of a reassembled PU] 355086 208.216 138.100.10,122 SSL¥3 Server Hello, Certificate, Server Hello Done 355203 210.122 195.149.208.216 © TUP = -2877 > https [ACK] Seq=79 Ack=2744 win=65535 Len=0 356366 10.122 195.149.208.216 SSLv3_ Client Key Exchange, Change Cipher Spec, Encrypted Handshake 360909 208.216 138.100, 10.122 Top https > 2677 [ack] Sa 83 Win=24820 Le fa Frame 71 (i2i bytes on wire, 121 bytes captured) la Ethernet 11, Src: 138.100.8.125 (00:04:dd:70:65:42), Dst: 138.100.10.122 (00:40: f4:b0:f2:d3) a Internet Protocol, Src: 195.149.208.216 (195.149.208.216), Ost: 138.100.10.122 (138.100.10.122) a Transmission Control Protocol, Src Port: https (443), Dst Port: 2677 (2677), Seq: 2744, Ack: 283, Len: 67 ls Secure Socket Layer SSSLV3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec Content Type: Change Cipher Spec (20) Version: SSL 3.0 €x0300) Length: 1 Change Cipher Spec Message 2 SSLV3 Record Layer: Handshake Protocol: Encrypted Handshake Message Content Type: Handshake (22) Version: SSL 3.0 (x0300) Length: 96 Handshake Protocol: Encrypted Handshake Message DO a0 te pot? ds oo OF dda 65 a2 Of 0D 4s OO 00 6b 7c by 40 00 35 06 OF 89 c3 95 dD dB Ba 64 Oa 7a Ql bb Oa 75 bb BF 10 83 67 42 di be 50 18 8D FA FB 65 00 00 14 03 OO 00 O1 Ol 16 03 OD dO Fb: “DAULEVAR_CAS@VLEVAR_CASE [Pr 4lb D146 MID ZCem Uersneed [eae ese Fo GBHAAGe OA« eS Be SSFIL SS QQQHRAHKGD ~ Bepressien.. Clear érply Destination Protical | Info 354927 208.216 138.100. 10.122 Top [Ter seoment of a reassembled POU] +355066 208.216 138.100. 10.122 SSL¥3 Server Hello, Certificate, Server Hello Done 1355203 10.122 295.149.208.216 TCP 2677 > https’ [ACK] Seq=79 ack=2744 win=65535 Len=0 - 356366 10.122 195.149.208.216 SSLv3_ Client Key Exchange, Change Cipher Spec, Encrypted Handshake 2360903 208.216 138.100. 10.122 Top https > 2677 [ACK] Seq=2744 Ack=283 Win=24820 Le! 375036 2081216 1381100. 10.122 S5LVv3 Change Cipher Spec, Encrypted Handshake Message 76 3.486918 195.149.208.216 138.100, 10,122 SSLv3 Application Oata 77 2 ag7aza as" taa"dne a1R 72a IAN’ 1A 199 Ssiv2_annlicarinn nara fa Frame 75 (465 bytes on wire, 469 bytes captured) la Ethernet 11, Src: 138.100.10.122 (00:40:f4:bO:f2:d3), Dst: 138.100.8.125 (00:04:dd:70:65:42) a Internet Protocol, Src: 138.100.10.122 (138.100.10.122), Dst: 195.149.208.216 (195.149.208.216) la Transmission Control Protocol, Src Port: 2677 (2677), Dst Port: https (443), Seq: 283, Len: = Secure Socket Layer zi SEEM TE Content Type: Application Data (23) Version: SSL 3.0 (0x0300) Length: 410 Application pata