If you still run a non-TLS web server, you may occasionally find requests like the following in your weblogs:

\x16\x03\x01\x01\x07\x01
\x16\x03\x01\x01\x06\x01
\x16\x03\x01\x01\x05\x01
\x16\x03\x01\x01\x03\x01
\x16\x03\x03\x01\xa6\x01
\x16\x03\x03\x01\xa7\x01

If the request includes nonprintable characters, the "\x" notation will show up in weblogs. While this may occasionally be used in attacks, the requests above are TLS requests received by a non-TLS server.

We covered this before but continue to keep getting questions about these particular entries.

The first byte, 0x16 (22 in decimal), indicates that the message is a handshake record. This is followed by the TLS version. TLS version "3.1" is TLS 1.0 (remember that TLS is a renaming of SSL, and TLS 1.0 follows SSL 3.0). 

Finally, you will see two bytes that indicate the length of the following message, usually a handshake header. The handshake header will often include a 0x00 byte, which will terminate the "string" as far as the Apache logging function is concerned, so usually, you only see the first 5 or 6 bytes. FWIW: The version "TLS 1.0" doesn't indicate that you deal with an outdated (or artificial) client. This version pertains to the overall message formatting. Later as part of the client hello, the client may indicate the supported TLS version.

As a great reference to decode TLS headers, see https://tls.ulfheim.net.

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|