🚀 go-pugleaf

In article <322AE9A8.3F54BC7E@itr.ch>,
Roger Auinger <rauinger@itr.ch> writes:

> Hi 
> 
> I've captured a Client-Hello with my sniffer from Netscape 3.0 to a
> first: 
> 
>    configuration in the Netscape browser: 
> 
>       SSL2                                              disabled
>       SSL3                                              enabled 
>       RC4 encryption with a 40-bit key and an MD5 MAC   enabled
>       RC2 encryption with a 40-bit key and an MD5 MAC   disabled
>       No encryption with an MD5 MAC                     disabled 
>       
>    The client-browser is installed on a PC (pentium) with Windows 95.  
>    
> **************************************************************************
> 
> second:
> 
>    configuration in the Netscape browser:
>    
>       The configuration in the Netscape browser is exactly the same 
>       as above.
>    
>    The main difference to above is that client-browser is installed on a
>    SUN with SunOS 4.1.4
>    
>    
> **************************************************************************
> 
> 
> Questions: 
> 
> Can anybody explain what content the value 0x80 on address 0036 has? The
> value
> occurres in both TCP-sequences.
> 

Data says it's SSL3, but is encoded with SSL2 specification (I suppose the first message a browser sends dos this for compatibility with older servers?)
 08 1F means "length expressed in 2 bytes, and equals 001F"
 
> wHY i'M HAving to different numbers of bytes if I use two different
> machines?
> What could be the reason for this?
The PC ciphers in the packet are RC2-128(40)-MD5 (NOT RC4)
The SUN ciphers are RC2-128(40)-MD5, RC4-128(40)-MD5
(Maybe not restarting browsers after setting configuration?)
The additional cipherspec takes the 3 bytes you ask for

> If I get a connection with the PC the content type is 0x1F on Address
> 0037 
> in the handshaking. I've nowhere found this content type in the SSL3
> documentation. The content type if I connect with the SUN is o.k. !
As said above it's encoded with SSL2. 1F (and 22) express here a length

-- 
#include <std/disclaimers.h>  my.opinions!=HP.opinions
if (dislike(contents)) {system("/bin/flame",">/dev/null")}
		------	Juan Postlbauer	------