Recently I read some articles about SSL protocol, and analyze some SSL packets in wireshark. As far as I understood, after an APPLICATION DATA message, we shouldn't see any client hello ro server hello or certificate message.
I wrote a code to dissect SSL packets, and i saw a log which specified that this rule is broken, but unfortunately i lost that input pcap. Is it possible to have a client/server hello or certificate message after an application data message?