"schannel 36887 fatal alert 80" question.

[Kyle1886]

Periodically I have been getting "Schannel fatal error" in my event viewer. Today I received one, though the "time" does not correspond to a time I was on line; that I recall anyway.

I did the standard Google and Event ID searches but still clueless.

schannel 36887 fatal alert 80

Is there a way to backtrack and find which site generated the error?

So far, nothing serious has occurred with the event at that time periods logged.

(No viruses/spyware apparent). (Anti-virus auto-updates, but does not give a time stamp---just version number. I'm looking into that aspect too).

Thank you for any insight.

Respectfully
Kyle1886

[stilly]

perhaps it was an update via http that some service uses?

[Kyle1886]

Thanks for the response Stilly,

That's about the only thing I can figure, but which one?

Google, does an update about every 5 hours, but leaves a timestamp.

I know Microsoft issued an update in Nov. that did dastardly things for some, schannel wise, but I think that was fixed.

Thanks again
Kyle

[ocabj]

It sounds like an SSL/TLS negotiation / handshake error.

[Kyle1886]

Ocabj, is there a way to find who or where the "negotiation / handshake error" originates? Who is being the bad guy here, my PC or the third party server somewhere?

inquiring minds need to know these things...

Respectfully,
Kyle

[ocabj]

Ocabj, is there a way to find who or where the "negotiation / handshake error" originates? Who is being the bad guy here, my PC or the third party server somewhere?

inquiring minds need to know these things...

Respectfully,
Kyle

I found this interesting document this morning: http://blogs.msdn.com/b/kaushal/arch...ert-codes.aspx

As far as what originated it, I'm not sure how to ascertain that. On a *nix capable system, I would use lsof or something of that nature to figure out what processes are opening network connections. I think netstat -b does that in Windows. Of course, this requires you to run that command while the connection is open.

You could run something like OSSEC and have it run realtime monitoring of the Event Viewer, and then have an active response script trigger whenever it sees that schannel event.

[Kyle1886]

Thanks for the info / link Ocabj.

Respectfully,
Kyle