I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM.
Why is CBC most used? Is there a specific property that makes CBC preferred by web communications?
Also literature suggests that the non-feedback modes (e.g., counter mode) perform better in practice; however GCM shows up in only a few cipher suites. Any ideas why?