SSL handshake encoding and identifying

Question

Hi, i am trying to block ssl handshakes before the secure connection is established. So can anyone advice me how to do this. I allready have access to all data transfered to network using Winsock SPI(LSP). But how can i identify that now there is a request for SSL connecion? the data needed for establisment cant be crypted but are encoded in some way. I cant find the format anywhere.

If you have any idea about this, please let me know. I am doing this in c++.

Answer 1

While I think what you are doing is totally dubious, well, the best place to start is this document: The SSL Protocol - it describes the actual packet format used by SSL to envelope the encrypted data.