| ssl.alert_message | Alert Message | No value | Alert message |
| ssl.alert_message.desc | Description | Unsigned 8-bit integer | Alert message description |
| ssl.alert_message.level | Level | Unsigned 8-bit integer | Alert message level |
| ssl.app_data | Application Data | No value | Payload is application data |
| ssl.change_cipher_spec | Change Cipher Spec Message | No value | Signals a change in cipher specifications |
| ssl.handshake | Handshake Protocol | No value | Handshake protocol message |
| ssl.handshake.cert_type | Certificate type | Unsigned 8-bit integer | Certificate type |
| ssl.handshake.cert_types | Certificate types | No value | List of certificate types |
| ssl.handshake.cert_types_count | Certificate types count | Unsigned 8-bit integer | Count of certificate types |
| ssl.handshake.certificate | Certificate | Byte array | Certificate |
| ssl.handshake.certificate_length | Certificate Length | Unsigned 24-bit integer | Length of certificate |
| ssl.handshake.certificates | Certificates | No value | List of certificates |
| ssl.handshake.certificates_length | Certificates Length | Unsigned 24-bit integer | Length of certificates field |
| ssl.handshake.challenge | Challenge | No value | Challenge data used to authenticate server |
| ssl.handshake.challenge_length | Challenge Length | Unsigned 16-bit integer | Length of challenge field |
| ssl.handshake.cipher_spec_len | Cipher Spec Length | Unsigned 16-bit integer | Length of cipher specs field |
| ssl.handshake.cipher_suites_length | Cipher Suites Length | Unsigned 16-bit integer | Length of cipher suites field |
| ssl.handshake.cipherspec | Cipher Spec | Unsigned 24-bit integer | Cipher specification |
| ssl.handshake.ciphersuite | Cipher Suite | Unsigned 16-bit integer | Cipher suite |
| ssl.handshake.ciphersuites | Cipher Suites | No value | List of cipher suites supported by client |
| ssl.handshake.clear_key_data | Clear Key Data | No value | Clear portion of MASTER-KEY |
| ssl.handshake.clear_key_length | Clear Key Data Length | Unsigned 16-bit integer | Length of clear key data |
| ssl.handshake.comp_method | Compression Method | Unsigned 8-bit integer | Compression Method |
| ssl.handshake.comp_methods | Compression Methods | No value | List of compression methods supported by client |
| ssl.handshake.comp_methods_length | Compression Methods Length | Unsigned 8-bit integer | Length of compression methods field |
| ssl.handshake.connection_id | Connection ID | No value | Server's challenge to client |
| ssl.handshake.connection_id_length | Connection ID Length | Unsigned 16-bit integer | Length of connection ID |
| ssl.handshake.dname | Distinguished Name | Byte array | Distinguished name of a CA that server trusts |
| ssl.handshake.dname_len | Distinguished Name Length | Unsigned 16-bit integer | Length of distinguished name |
| ssl.handshake.dnames | Distinguished Names | No value | List of CAs that server trusts |
| ssl.handshake.dnames_len | Distinguished Names Length | Unsigned 16-bit integer | Length of list of CAs that server trusts |
| ssl.handshake.encrypted_key | Encrypted Key | No value | Secret portion of MASTER-KEY encrypted to server |
| ssl.handshake.encrypted_key_length | Encrypted Key Data Length | Unsigned 16-bit integer | Length of encrypted key data |
| ssl.handshake.key_arg | Key Argument | No value | Key Argument (e.g., Initialization Vector) |
| ssl.handshake.key_arg_length | Key Argument Length | Unsigned 16-bit integer | Length of key argument |
| ssl.handshake.length | Length | Unsigned 24-bit integer | Length of handshake message |
| ssl.handshake.md5_hash | MD5 Hash | No value | Hash of messages, master_secret, etc. |
| ssl.handshake.random | Random.bytes | No value | Random challenge used to authenticate server |
| ssl.handshake.random_time | Random.gmt_unix_time | Date/Time stamp | Unix time field of random structure |
| ssl.handshake.session_id | Session ID | Byte array | Identifies the SSL session, allowing later resumption |
| ssl.handshake.session_id_hit | Session ID Hit | Boolean | Did the server find the client's Session ID? |
| ssl.handshake.session_id_length | Session ID Length | Unsigned 8-bit integer | Length of session ID field |
| ssl.handshake.sha_hash | SHA-1 Hash | No value | Hash of messages, master_secret, etc. |
| ssl.handshake.type | Handshake Message Type | Unsigned 8-bit integer | SSLv2 handshake message type |
| ssl.handshake.verify_data | Verify Data | No value | Opaque verification data |
| ssl.handshake.version | Version | Unsigned 16-bit integer | Maximum version supported by client |
| ssl.pct_handshake.type | Handshake Message Type | Unsigned 8-bit integer | PCT handshake message type |
| ssl.record | Record Layer | No value | Record layer |
| ssl.record.content_type | Content Type | Unsigned 8-bit integer | Content type |
| ssl.record.is_escape | Is Escape | Boolean | Indicates a security escape |
| ssl.record.length | Length | Unsigned 16-bit integer | Length of SSL record data |
| ssl.record.padding_length | Padding Length | Unsigned 8-bit integer | Length of padding at end of record |
| ssl.record.version | Version | Unsigned 16-bit integer | Record layer version. |