Let's FIX a BROKEN TLS Handshake // with Wireshark

A client reached out and said that some clients were able to connect to a secure application and others were not. Let's peek at the handshake and see what happened. (pcap used with permission)

Got questions? Let's get in touch.

== More On-Demand Training from Chris ==

== Live Wireshark Training ==

== Private Wireshark Training ==

//TLS Course from Practical Networking//
Want to go deeper into TLS? Check out my buddy Ed's course:

Links above contain affiliate links where I will receive a small amount for any goods purchased. I thank you for clicking because it really helps to support me!!

0:00 Intro
0:28 TLS Client Hello
1:36 Fatal TCP Error
2:04 TLS Protocol Versions
2:46 Why TLS 1.0?
3:37 Conclusion

[cristobalvalladares]

You sir are a godsend. Thank you. I'm a network engineer switching to security. My first view of Wireshark left me in shock. Your videos are helping me to get a better picture. Less shock now. Thanks!

[brianmurray]

This was good stuff. You should do one on IKEv1 vs IKEv2, and Ike with NAT-T with asynchronous agreement.

[abdirahmanabdullahi]

Chris you show as what universities didn’t teach before thank you very much legend

[TheSprog]

Thanks to watching this I managed to spot a TLS problem saving me hours, mine was a "Fatal Handshake Failure", Many thanks Chris keep up the excellent work :)

[vyasG]

Excellent Video. These real world examples are very valuable. Thank you so much. Do you have or plan to make any content on wireless Troubleshooting?

[homayounshokri]

Excellent
can you make videos on DNS traffic analysis ?

[Black_Swan]

Good work. I noticed when i see your videos i feel like i know everything but when i'm working with Client my head start spinning. I think i need to spend some time to get confidence.

One i think i can say for sure. Since I've subscribed your channel and trying to keep up with every new video you upload here my knowledge of Wireshark has been increased and all credits goes to you!!!
Recently i took one your course "Foundational TCP Analysis with Wireshark" at Pluralsight. AMAZING WORK!!!

Thanks Chris. You are the BEST!!!

[mk-ornm]

Hey Chris, awesome work. Can you show us the DTLS?

[PeterTeehan]

I see this happen all the time in Direct Routing scenarios. The TLS 1.0 if I recall is actually deprecated and the new protocol is TLS 1.2 or higher. Once the customer updates TLS PSTN calls works. Thanks Chris amazing as always.

[MrBitviper]

awesome stuff as always chris
when it comes to learning about wireshark and packet analysis you're the go to guy
keep up the good work and keep em coming

[notnull]

great video, i ran into a similar problem at work, customer was blaming our application it turned out to be a bug in fortigate web filter

[sri]

Thank you for good information at evening time

[AshishKumar-qigk]

Hey Chris, love your videos. Can you make a video about the tcpdump, tshark etc. I saw your talk on David's channel and you mentioned ring buffers and rotating pcaps. Would be great if you could discuss the same.

[CyberNancy]

I’m guessing that a TLS update via the browser on the client is what was needed to fix this problem?

Just consistently excellent content as usual from Chris.

[chrisworthen]

I have a question. I’m having similar issues but I’m not seeing that handshake start. I see a bunch of TCP traffic but no client hello or sever hello.

[EngrDJDebug]

can you do some videos about ssh issues

[beludsden]

Hey Chris, I just stumbled upon your youtube page and wish I had this years ago when I was learning all this stuff, hah! I am currently working on a research project involving TLS and would love to ask you a rather specific question. Would your business email be okay to reach you at? Thank you for everything you're doing here and keep up the amazing quality of videos!

[krishangopal]

u r awesome... as alwayz ...
thanks for sharing this...

[energy]

Starting form 2:25 you selected 'Version : TLS 1.0', however there is another 'Version : TLS 1.0' below, is there any difference between them? or they are saying the same thing?

[abhaypratap]

In tls v 1.3 u can't inspect much data using Wireshark