1
$\begingroup$

Im looking at a Client Hello message in wireshark, the client supports 1.2 and 1.3, but Wireshark says the client used TLSv1.3 record layer when the server hasn't replied yet the choosen version. Wireshark snapshot How can this be explaned?

Also, why after that i see version 1.0 and version 1.2 if version 1.3 was used?

Improve this question
$\endgroup$
4
2
$\begingroup$

TLS 1.3 record layer is shown because the ClientHello contains TLS 1.3 as supported version. This can be seen at the bottom of the following image. See also TLS record layer and Handshake protocol at ask.wireshark.org.

enter image description here

Improve this answer
$\endgroup$
1
  • $\begingroup$ And this mostly-nonuse of the record layer version, and even the fixed/legacy version in ClientHello and ServerHello, replaced by the new supported_versions extension, is detailed in RFC8446 5.1-2, 4.1.2-3, 4.2.1, and Appendix D. $\endgroup$ – dave_thompson_085 Jan 16 at 3:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.