TLS version unknown-64282

Zeek
1

Hi All,

I'm using the latest zeek on alpine 3.8. In recent instagram tls traffic,

I see tls version unknown-64282. The resumed flag is set to true.

What is tls version unknown-64282.

Regards,

Daniel

2

Hi Daniel,

this means that Zeek saw a TLS connection that specified 64282 as the version number. Translating that to hex helps in that case - this is 0xFB1A.

Which is (as far as I know) a Facebook variant of TLS 1.3. Which has no official IANA assigned name.

I hope this helps,
  Johanna