[Zeek] [zeek] TLS version unknown-64282

[Johanna Amann]

Hi Daniel,

this means that Zeek saw a TLS connection that specified 64282 as the 
version number. Translating that to hex helps in that case - this is 
0xFB1A.

Which is (as far as I know) a Facebook variant of TLS 1.3. Which has no 
official IANA assigned name.

I hope this helps,
  Johanna

On 10 Jan 2019, at 4:59, Daniel Guerra wrote:

> Hi All,
>
> I'm using the latest zeek on alpine 3.8. In recent instagram tls 
> traffic,
>
> I see tls version unknown-64282. The resumed flag is set to true.
>
> What is tls version unknown-64282.
>
>
> Regards,
>
> Daniel
>
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek