Consider the Wireshark output below in figure 5 for a portion of an SSL session.

a) With a suitable diagram, based on the observation of figure 5 packet exchange, to explain what are the three phases for a SSL session? b) Is Wireshark packet 112 sent by the client or server? c) What is the server's IP address and port number? d) Assuming no loss and no retransmissions, what will be the sequence number of the next TCP segment sent by the client? e) How many SSL records does Wireshark packet 112 contain? f) Does packet 112 contain a Master Secret or an Encrypted Master Secret or neither? g) Assuming that the handshake type field is 1 byte and each length field is 3 bytes, what are the values of the first and last bytes of the Master Secret (or Encrypted Master Secret)? h) The client encrypted handshake message takes into account how many SSL records? i) The server encrypted handshake message takes into account how many SSL records?

ss! No Time 106 21.805705 188 21.830201 111 21.8535 20 112 21.876168 113 21.945667 114 21.954189 122 23.489352 149 23.559497 Source 128.238.38.162 216.75.194.228 216.75.194.228 128.238.38.162 216.75.194.220 128.238.38.162 216.75.194.228 216.75.194.22e Destination 216.75.194.220 128.238.38.162 128.238.38.162 216.75.194.220 128.238.38.162 216.75.194.228 128.238.38.162 128.238.38.162 Protocol SSLV2 SSLV3 SSLv3 SSLV3 w SSLv3 SSLV3 SSLV3 SSLV3 Length Info 132 Client Hello 1434 Server Hello 790 Certificate, Server Hello Done 258 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 121 Change Cipher Spec, Encrypted Handshake Message 806 Application Data 272. Application Data 1367 Application Data > Frame 112: 258 bytes on wire (2064 bits), 258 bytes captured (2064 bits) > Ethernet II, Src: IBM_10:60:99 (89:69: 6b: 10:68: 99), Dst: All-HSRP-routers_ee (80:00:8c:07: ac:00) > Internet Protocol Version 4, Src: 128.238.38.162, Dst: 216.75.194.220 > Transmission Control Protocol, Src Port: 2271, Dst Port: 443, Seq: 79, Ack: 2785, Len: 284 Transport Layer Security SSLv3 Record Layer: Handshake Protocol: Client key Exchange Content Type: Handshake (22) Version: SSL 3. (@x300) Length: 132 > Handshake Protocol: Client Key Exchange SSLv3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec Content Type: Change Cipher Spec (20) Version: SSL 3.0 (@x@3ee) Length: 1 Change Cipher Spec Message SSLv3 Record Layer: Handshake Protocol: Encrypted Handshake Message Content Type: Handshake (22) Version: SSL 3.0 (x300) Length: 56 Handshake Protocol: Encrypted Handshake Message ee3efd 1f c2 de ee ee 16 03 88 ee 84 le ce ce 80 bd 8848 49 49 47 29 sa 25 98 47 7f de 59 85 6a e7 89 5 TTG) %-G 8050 c7 76 12 af 88 b4 70 60 9e 61 fl 64 be fo f8 3.... 8868 41 ce sd ce le 93 9c ad le ce 82 e dd e2 58 bA.... 007 96 45 51 c7 3f bd ee cd 92 c4 27 5d Ff dd fb 99KQ-? 8888 42 3d a4 b7 71 ee ce ff c ce b2 ed 6e se 6c dB... .....1 eese 84 6e 5a 08 98 2e 52 ee b5 bc di c4 f5 63 fe enz R oad H 29 f1 c ba 64 58 79 45 9e 3 c fa g Th 7 P) - *dxy F-> Bebe 82 84 e9 32 f6 1d 7a al 20 cf d2 la 18 64 29 14 2.2. -**.d) Bece es se ee ei ei 16 e3 Be 9 38 29 a9 dc 11 5a 74 ******** *8). Zt > Handshake protocol mesrage (tis.handshake), 132 bytes Packets: 336. Displayed: 59 (17.6%) : : Profile: Default Figure 5 Wireshark output