[Zeek] [zeek] TLS version unknown-64282
Johanna Amann
johanna at icir.org
Thu Jan 10 06:40:21 PST 2019
Hi Daniel,
this means that Zeek saw a TLS connection that specified 64282 as the
version number. Translating that to hex helps in that case - this is
0xFB1A.
Which is (as far as I know) a Facebook variant of TLS 1.3. Which has no
official IANA assigned name.
I hope this helps,
Johanna
On 10 Jan 2019, at 4:59, Daniel Guerra wrote:
> Hi All,
>
> I'm using the latest zeek on alpine 3.8. In recent instagram tls
> traffic,
>
> I see tls version unknown-64282. The resumed flag is set to true.
>
> What is tls version unknown-64282.
>
>
> Regards,
>
> Daniel
>
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
More information about the Zeek
mailing list