Hello guys this is my first question here.
For my customer i was analyzing this ( anonymized ) capture because a SSL Handshake issue but i noted at first that TCP three way handshake is not as expected .
If you look at the screenshot , the three way handshake ACK ( third packet ) has the PUSH flag enabled because is carrying 178 bytes of payload.
With the original capture this packets contains the ssl ClientHello message.
How is it possible? This is not the TCP Fast Open (RFC 7413) , SYN and SYN+ACK don't contain the "fast open" option . The client is an IIS server which connects to a LDAPS server. Do you know any explanation about this behaviour? is there any standard or related RFC ?