{"record":{"id":"49ae38032a694c75","repo":"gchq/CyberChef","slug":"not-a-known-handshake-message","errorCode":null,"errorMessage":"Not a known handshake message.","messagePattern":"Not a known handshake message\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/TLS.mjs","lineNumber":100,"sourceCode":"        length: 3,\n        data: b.getBytes(3),\n        value: s.readInt(3)\n    };\n    if (s.length !== h.handshakeLength.value + 4)\n        throw new OperationError(\"Not enough data in Handshake message.\");\n\n\n    switch (h.handshakeType.value) {\n        case 0x01:\n            h.handshakeType.description = \"Client Hello\";\n            parseClientHello(s, b, h);\n            break;\n        case 0x02:\n            h.handshakeType.description = \"Server Hello\";\n            parseServerHello(s, b, h);\n            break;\n        default:\n            throw new OperationError(\"Not a known handshake message.\");\n    }\n\n    return h;\n}\n\n/**\n * Parse a TLS Client Hello\n * @param {Stream} s\n * @param {Stream} b\n * @param {Object} h\n * @returns {JSON}\n */\nfunction parseClientHello(s, b, h) {\n    // Hello version\n    h.helloVersion = {\n        description: \"Client Hello Version\",\n        length: 2,\n        data: b.getBytes(2),","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/TLS.mjs#L82-L118","documentation":"Thrown by the internal parseHandshake() in TLS.mjs when the handshake type byte is neither 0x01 (ClientHello) nor 0x02 (ServerHello). This parser only understands the two hello messages; any other handshake type (Certificate 0x0B, ServerKeyExchange 0x0C, etc.) is rejected in the switch default.","triggerScenarios":"Feeding a TLS handshake record whose body is a Certificate, ServerKeyExchange, ServerHelloDone, Finished, or any non-hello message. Also reached when the byte offset is wrong (the type byte is read from the wrong position) or when the record is a hello fragment whose first body byte was misinterpreted.","commonSituations":"Capturing a full handshake and passing each record to this parser without filtering by handshake type; using the parser to inspect a renegotiation or post-handshake message; misaligned parsing due to a previous length error masking the real type byte.","solutions":["Only pass ClientHello (type 0x01) or ServerHello (type 0x02) handshake messages to this parser.","If you need other handshake types, this parser does not implement them — use a complete TLS dissector.","Double-check that the bytes handed to parseTLSRecord start exactly at a handshake record header so the type byte is read from offset 5."],"exampleFix":"// before: passing a Certificate handshake record\nparseTLSRecord(certRecordBytes); // type byte 0x0B\n// after: filter for hello messages first\nif (recordBytes[5] === 0x01 || recordBytes[5] === 0x02) {\n    parseTLSRecord(recordBytes);\n}","handlingStrategy":"validation","validationCode":"function isHelloHandshake(recordBytes) {\n    // handshake type byte sits at offset 5 (after the 5-byte TLS record header)\n    return recordBytes.length >= 6 &&\n        recordBytes[5] === 0x01 || recordBytes[5] === 0x02;\n}\nif (!isHelloHandshake(bytes)) {\n    throw new Error(\n        `parseTLSRecord only decodes ClientHello (0x01) / ServerHello (0x02). ` +\n        `Got handshake type 0x${(bytes[5] ?? 0).toString(16)}.`\n    );\n}\nconst r = parseTLSRecord(bytes);","typeGuard":"function isHelloHandshake(recordBytes) {\n    return recordBytes.length >= 6 &&\n        (recordBytes[5] === 0x01 || recordBytes[5] === 0x02);\n}","tryCatchPattern":"try {\n    record = parseTLSRecord(bytes);\n} catch (e) {\n    if (e instanceof OperationError && /Not a known handshake message/.test(e.message)) {\n        // skip Certificate/KeyExchange/etc. — this parser only does hellos\n        continue;\n    }\n    throw e;\n}","preventionTips":["Filter records by handshake type before parsing; this parser only handles ClientHello/ServerHello.","For a full handshake decode, use a complete TLS dissector rather than this hello-only parser.","Confirm correct byte alignment so offset 5 is genuinely the handshake type."],"tags":["tls","parsing","handshake","unsupported-message"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}