What happens when a client connects?
ฝัง
- เผยแพร่เมื่อ 10 ก.ค. 2024
- Want more hands-on content like this? Comment below!
How does the TLS handshake work? It all starts with the client hello. In this video we are going to dive into what information is sent to a server in this phase of the handshake and the beginnings of how an encrypted connection is set up.
====================
Download the pcap here:
github.com/packetpioneer/yout...
====================
For a much deeper dive into the TLS handshake and how it works, check out my buddy Ed's Practical ▶TLS course: www.bit.ly/PN-TLS
== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/pri...
0:00 Intro to TLS
0:27 The Handshake
1:04 The Client Hello
2:22 Version Negotiation
4:40 TLS 1.3 Extensions
6:01 Why wrong version?
6:34 Server Version
7:11 Cipher Suites
8:50 Server Name
9:40 Application Negotiation - วิทยาศาสตร์และเทคโนโลยี
Let's take a closer look at the client hello. Thanks for watching and please comment to let me know what you think of this content!
I think a deep dive would be great. I interview people quite often and most do not fully understand the steps to completing a TLS handshake. Everything from 'What are the 3 main things TLS/SSL provides?', to 'Walk me thru a TLS/SSL handshake in detail...', 'How does client authentication work?', or 'How does renegotiation work?' etc etc.
Keep up the great work!
Great vidio Mr. Chris for certificate initial analysis and view
We would like to you to present more vidios regarding the certificate topic , as it not clear for most of specialists , and deals with certificate tasks or troubleshooting by dummy steps with shortage of knowledge and deep understand .
It would be useful vidios if you continued to make vidios for wireshark certificate capture with common certificate issues to be diagnosed by the capture analysis
Like , untrusted certificates or self signed , and missmatch of TLS version issue or application version issue ... etc
My favourite guy on the internet. Thanks for amazing information as always.
Thanks a lot Chris , I was actually working on enabling ssl on my pihole yesterday , this video helped me a lot in understanding the versions and ciphers. Thanks once again for this clear explanation.
Your videos are awesome. I am a 20 year network veteran but I keep learning new stuff from you, or nifty WireShark features. Keep the good content up man, love it!
Thank you for the comment tom!
Thank you so much for the content you put out like this video. I eat up every video, the information is very helpful and the pace great as well. I'd love to keep hearing more about the TLS handshake but any videos with Wireshark in them are great too!
Fascinating Chris. Thanks for putting in the heavy lifting to break down the technology into English. Loving the content my guy
As good as ever Chris! Looking forward to the next episodes
Thank you Roland! And a special shout-out to Sake for looking it over first to make sure I didn't say anything completely stupid. 😄
Thank you, Chris, awesome video as always! Can't wait for the next one!
Thank you for the comment!
Thank you for the valuble updates,help me to refresh my mind.
Thanks, I would love to see more on TSL handshake
Hello Chris all of your wireshark videos have been helpful!!
Thank you!
came and subbed from your interview with David Bombal... great interview, btw.... Now, I gotta google TLS and how it relates to SSL :D
Thanks look forward to more videos on wireshark
Awesome intro. Can’t wait for the explanation of the rest of the TLS handshake.
Thank you! I can’t wait to make it!
Very crisp explanation 🙂
Thank you as always!
Very interesting video! Now it makes much more sense!👍
Glad you think so!
As always, great job,, excellent instructing style !
Thank you!
What a coincidence lol. I was looking for a TLS video on your channel last night and then you posted this video this morning lol. Thanks!🤣
Awesome! Thanks for the comment. I hope this video and the ones to follow help you to understand TLS!
Thanks Chris!
Appreciated.
Juan.
Amazing content
Hi Chris, Thank you so much for your time and effort. Great content as always .Could you do SSL offload on F5 and broken TLS
Great topic!! Chris, Great!
Glad you enjoyed it!
Thanks a lot Chris, really good video as usual. I did not know about the "supported version" extensions. It is a bit sad that they are planning to not have Server Name is plain text anymore. That field is really useful to know the name of a server (via HTTPS or RDP) when DNS do not have record of that server.
I agree! Too bad it probably won't be here forever. But hey, I will enjoy it while it lasts... www.cloudflare.com/learning/ssl/what-is-encrypted-sni/
You got my interest. Your explaination and pace is very refreshing. What do you recommend for beginners to learn wireshark? I am very interested in learning this technology.
Look no further! th-cam.com/video/OU-A2EmVrKQ/w-d-xo.html this video on my channel is great for beginners to learn wireshark.
I know we need the theory but the practical stuff you teach is very interesting.
Best explanation ever saw.. Thank you sir
Thank you! Please share with anyone you think could benefit.
Fantastic content as always Chris. Would be great to see some content on BGP too. :) Thanks for the hard work
Thanks for the suggestion!
Thank you for your informative videos! My basic understanding of TLS is that it is used between endpoint and server to negotiate which encryption algorithm and data integrity to use. What is less clear is whether TLS is itself an encryption protocol? I often see sites refer to it as encryption protocol. CN you clarify. Thank you!
Amazing content! I'd like to see some packet capture with tls handshake mismatching.
Great suggestion!
Love your videos
Thanks!
Great video thank you.🦈
Glad you enjoyed it
The version incompabilty pcap would be nice too see :)
Very informative video. At one point you hinted that the ServerName might be encrypted in the future. I think that always has to be plaintext for middle-boxes (reverse proxies) which don't terminate TLS. High traffic reverse proxies avoid terminating TLS because it prevents the use of something like splice(2) in the linux kernel which allows piping data from one TCP connection to another without any of the data needing to be decoded in userspace (or decoded at all, other than the ClientHello).
Hi Seth, totally agreed. But I think there will start to be instances where we see it encrypted in the near future. Here is one reference www.cloudflare.com/learning/ssl/what-is-encrypted-sni/
@@ChrisGreer First I'd heard of ESNI and ECH. I found the draft RFC in the link you provided.
(first impression)
Looks like ECH is compatible with the middle-box scenario I outlined (which the RFC calls a split-mode topology). It's distributing a public key via DNS, and providing a fallback where a client can complete negotiation with a server to learn the ECH public key direct from the server (at the cost of an extra round trip). Looks like the middle-boxes performing ECH would need access to the ECH private key, but not the TLS private keys of the backends that terminate TLS.
I also found RFC8744 which outlines "unanticipated use of SNI" in section 2.1 which provides the motivation for ECH. I didn't previously understand how SNI was being abused. The reason why Cloudflare is working on ESNI/ECH seems clear.
datatracker.ietf.org/doc/rfc8744/
Thank you for sharing your knowledge. I just found your channel today and now I got some binge-watching to do. 🙂
as alwasy clear precise, perfect my respect chris and good bless u, you make me less stupid at every video u made God bless u
Thank you!
I would absolutely like you to expound upon the versions tls starting with the acronym.
Thanks
Thanks 👍
No problem 👍
Hey chris, can i use wireshark when deploying openstack services
You sniff my mind really wanted to learn about this #Chris #TLS
Glad you like the content! I have been hoping to do this content for some time. It's gonna be fun to dig into.
Hey Chris please do a video as you mentioned about broken tls conversations.
Thanks for the feedback!
Funny to hear that TLS standard is planning to make the SNI go away (maybe just encrypt it in the future?). About a month ago, I was solving an issue for a customer, which turned out to be an old browser without SNI support trying to contact an SNI only server. The SNI field (or the absence of it) was key to the discovery of that problem. Encryption of that field would make the diagnosis very difficult.
Didn’t mean to be unclear… by “going away” I meant that there are efforts to encrypt it. ESNI - so yeah, not sure how widely it will be implemented, but one day we may not have it in the clear anymore…
www.cloudflare.com/learning/ssl/what-is-encrypted-sni/
@@ChrisGreer I guessed it would be encrypted rather than removed. It's kinda important nowadays ^_^
Agreed! Which is why when it gets encrypted a very useful troubleshooting data point will be lost!
Thank you for the content. Im highly interested why they went for 1.2 cause of some middle boxes. Where does the infos come from that they have to go this version to not let the packets drop?
If they put TLS 1.3 immediately at the handshake layer, what would a middlebox do that is inspecting TLS? If it doesn't yet support 1.3, it will probably drop and reset the connection. I'm very sure a ton of research and testing went into that aspect. The same is true for TCP and other protocols. It is hard to migrate things to new features over boxes that don't yet support those features, all the while still supporting endpoints that have not migrated either.
Thanks Chris, what will be best way to decrypt SSL communication in the server side with tshark
At that point, the only way I have seen it done is with a TLS proxy. But I am sure if you Google hard enough you will find others…here is an example. www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-17/security-book-xe/m-ssl-proxy.pdf
Hi Chris, great video, as always with all your videos. Thanks. I would be very interested in a video regarding issues with TLS version mismatch. I have a customer with an issue that seems related to this, but I cant figure it out so your video will be an awesome tool to try to understand. if you have some resources that could help it will be greatly appreciated.
Ok Gerardo, thanks for the feedback!
Chris,
Great video. I recently came across a TLS issue where the client sent the hello and never received the server hello back. There was some confusion to the Record version vs the Handshake protocol version. Thanks for clarification.
I ran into the same about a month or so ago, now that I saw this video I understand why there's TLS 1.0 in the first part and TLS 1.2 in the next. I think the issue is related to ciphers not being supported by the server because I also see no reponse from the server after the client hello. Hopefully Chris can confirm if that it is indeed expected behavior (or could be).
hello chris I really appreciate your work,thank you for sharing your knowledge I hope that u can answer my question ,in david's video where he explain tls we find that the client start with the change cipher spec but here we find that the server starts can you please explain why,hope you the best
Typically, the client gives a list of supported ciphers, the server selects one, then in 1.3, changes cipher spec to start using it. After that the client does the same and we complete the handshake. Hope that helps
@@ChrisGreer thanks chris for the help
I'm at the beginning of my IT journey. Currently Helpdesk, looking to move to Networking, then maybe SOC. Is this covered in any certification or is this on the job/experience learning?
Yeah there are several certs in the industry where having a good sense of packet analysis and protocols will help. CCNA, Net+, even Sec+ just to name a few
@chris geat video!!! A question..Out of curiosity.. is it possible that there could be a case where client's cipher suite doesn't match with the server ? In that case, will it be like client will not be able to access that server at all ?
That is correct, the server should return an error and the handshake will fail if there is a cipher mismatch. I am looking for a pcap to demo that - it would make a nice video!
Thank you so much!!! You are the best!!!
Can we look inside a quic packet? Is there a way to see http2/3 in plain text without a proxy in the middle?
th-cam.com/video/QRRHA_5hS2c/w-d-xo.html I did a video on how to capture the TLS 1.3 keys on the client side. I include the pcap and keylog in the video so you can follow along.
Hello Chris. It would be good to catch up sometime! I am looking at developing a new product, and would like to build a secure FTP server. So would that basically involve a client setting up a TLS connection and then requesting a FTP service connection within TLS? I'm pretty new to TLS, and it has been like 10 years since I messed around with SSL.
Thanks for you channel. It is making me excited to be able to use Wireshark hopefully soon for some real network development.
Hey! There are a few ways of securing FTP - here is a quick article that shows the different ways to approach it - www.jscape.com/blog/understanding-key-differences-between-ftp-ftps-and-sftp. In short, you can do it over TLS or via SSH.
@@ChrisGreer Great link. Thanks!
Nice one Chris😄. Good luck for your BlackHat and Defcon session. I'll one day meet you there in few years!!!
Thanks Faran! For sure, hope to meet you in person one day.
Yes,we would like to see broken communication due to tls mismatch
Thanks for the comment!
Broken TLS video, please! :)
Hi, I would like to see the corrupt version of a handshake ;) !!
For sure! I will make a video for that
@@ChrisGreer Cant wait :) ! Love your videos !! :)) Thanks for sharing your knowladge !
When I type tcp contains wireshark or any other site, my display filter show red as its invalid.
Need to add quotes around the word your are searching for in new release of Wireshark. tcp contains "wireshark"
Why am I getting alert from client side TLS 1.3 - ALERT LEVEL - FATAL - DESCRIPTION PROTOCOL VERSION and then client sending a rst
when I have the exact same client hello as in this video
Could you share the pcap? packetpioneer (at) gmail.com
You always have an excuse that stops you from starting a business, Then you are the one to demolish the excuses and get started ! a fellow creator][][][
Your eyes are green
You got my interest. Your explaination and pace is very refreshing. What do you recommend for beginners to learn wireshark? I am very interested in learning this technology.