Appendix M — Client Hello Bytes Answers

Completed Check

The Client Hello hex dump becomes socket-ready data with bytes.fromhex(). TLS record lengths use network byte order, which is big-endian. When Python uses native byte order, it follows the host machine: most modern consumer systems are little-endian, while big-endian systems make Python’s native byte order big-endian too.

from fixtures.local_targets import course_root, hex_to_bytes

hello = hex_to_bytes((course_root() / "data" / "tls_handshake.txt").read_text())
print(len(hello))
print(int.from_bytes(hello[3:5], byteorder="big"))

225
220

The fixture text is useful for humans, but socket code needs bytes. bytes.fromhex() performs that translation, and big-endian interpretation gives the TLS record length expected by the protocol.

The tiny trap is that the same bytes can become different numbers depending on byte order. Protocol documentation, not guesswork, tells us which interpretation is correct.

References: bytes.fromhex(), struct, RFC 5246, RFC 6520, and CVE-2014-0160.