For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sam_D_'s avatar
Sam_D_
Icon for Altostratus rankAltostratus
May 07, 2020

TLS versions in ClientHello

I'm wondering how I can read TLS versions such as TLS version in Record Layer and the Max supported TLS version from ClientHello message by using: when CLIENTSSL_CLIENTHELLO { }
LTM
security
jaikumar_f5's avatar
jaikumar_f5
Icon for Noctilucent rankNoctilucent
May 09, 2020

May we know what is the requirement here, this should be a troubleshooting via wireshark. The Client will always give the lowest supported protocol on the record layer and in the handshake protocol with the highest. There should not be any handshake failures because of record layer protocol.

 

If you still want it, you have to dissect the packets like below,

 

https://devcentral.f5.com/s/articles/advanced-irules-binary-scan-20453

  • Sam_D_'s avatar
    Sam_D_
    Icon for Altostratus rankAltostratus
    May 11, 2020

    We are investigating a reported issue from our customer that they often receives Connection Reset after SSL Handshake. we suspect that it is related to the outdated version TLSv1.0/1 is being used by that customer either in TLS version for Record Layer or with the Max supported TLS version in the Client-Hello message itself