Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Reminder: Decoding TLS Client Hellos to non TLS servers - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Reminder: Decoding TLS Client Hellos to non TLS servers

If you still run a non-TLS web server, you may occasionally find requests like the following in your weblogs:


If the request includes nonprintable characters, the "\x" notation will show up in weblogs. While this may occasionally be used in attacks, the requests above are TLS requests received by a non-TLS server.

We covered this before but continue to keep getting questions about these particular entries.

The first byte, 0x16 (22 in decimal), indicates that the message is a handshake record. This is followed by the TLS version. TLS version "3.1" is TLS 1.0 (remember that TLS is a renaming of SSL, and TLS 1.0 follows SSL 3.0). 

Finally, you will see two bytes that indicate the length of the following message, usually a handshake header. The handshake header will often include a 0x00 byte, which will terminate the "string" as far as the Apache logging function is concerned, so usually, you only see the first 5 or 6 bytes. FWIW: The version "TLS 1.0" doesn't indicate that you deal with an outdated (or artificial) client. This version pertains to the overall message formatting. Later as part of the client hello, the client may indicate the supported TLS version.

As a great reference to decode TLS headers, see

Johannes B. Ullrich, Ph.D. , Dean of Research,

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS Cyber Defence Japan August 2022


4515 Posts
ISC Handler
Feb 14th 2022

Sign Up for Free or Log In to start participating in the conversation!