If TLS 1.3 is negotiated, it MUST be set to 0x0303 ('TLS 1.2'). Server Hello - Version: negotiated version (for TLS 1.2 and before).The server sends a Server Hello handshake message with: This is the only value used by TLS 1.3 implementations (which may agree TLS 1.3, 1.2 or other versions). Client Hello - Supported Versions Extension: list of supported versions.In TLS 1.3, this field is not used but MUST be set to 0x0303 ('TLS 1.2'). Client Hello - Version: maximum supported TLS version (in TLS 1.2 and before).In TLS 1.3, this field is not really used and MUST be 0x0303 ('TLS 1.2') or 0x301 ('TLS 1.0') for compatibility purposes. TLS Record - Version: minimum supported TLS version (in TLS 1.2 and before).

The client sends a Client Hello handshake message in a TLS record containing: Recall that TLS sessions begin with a handshake to negotiate parameters such as the protocol version and ciphers. Wireshark reports TLS 1.3 in the protocol column due to Server Hello containing a Supported Versions extension with TLS 1.3. Why does Wireshark show in the overview Protocol TLSv1.3 but in the details Version TLS 1.2? This agrees with what Wireshark displays:

(See Appendix D for details about backward compatibility.) Present with 0x0304 as the highest version indicated therein. TLS 1.3 ClientHellos are identified as havingĪ legacy_version of 0x0303 and a supported_versions extension Legacy_version field MUST be set to 0x0303, which is the version 'supported_versions' extension (Section 4.2.1) and the TLS 1.3, the client indicates its version preferences in the Intolerance' in which the server rejects an otherwise acceptableĬlientHello with a version number higher than it supports.

Experience has shown that many serversĭo not properly implement version negotiation, leading to 'version Version negotiation and represented the highest version number Legacy_version: In previous versions of TLS, this field was used for ProtocolVersion legacy_version = 0x0303 /* TLS v1.2 */ Sorry, for the confusion, I was missing the exact TLS 1.3 semantics: For instance, in the Client Hello, the field 'version' must contain the fixed value 0x0303 (TLS 1.2), while the prefered version is contained in the extension 'supported versions'.

Wireshark protocol filter tls