Scapy-ssl_tls: does crafting ssl layer packets require dport 443?

Question

I am attempting to create a traffic flow using either https or http

I am having issue with crafting ssl layer packets on dports outside of dport 443. I am also having issues crafting normal packets with Raw data on dport 443.

first packet i create has tcp dport=443 and when i use show2() the SSL layer appears

p = Ether()/IP(src="1.2.3.4", dst='4.3.2.1',flags="DF")/TCP(sport=12345, dport=443, flags="PA", ack=1111, seq=3222)/SSL(records=[TLSRecord()/TLSHandshake()])
p.show2()
###[ Ethernet ]###
  dst= 00:26:52:ce:5f:49
  src= 34:23:87:20:76:59
  type= IPv4
###[ IP ]###
     version= 4L
     ihl= 5L
     tos= 0x0
     len= 49
     id= 1
     flags= DF
     frag= 0L
     ttl= 64
     proto= tcp
     chksum= 0x30bd
     src= 1.2.3.4
     dst= 4.3.2.1
     \options\
###[ TCP ]###
        sport= 12345
        dport= https
        seq= 3222
        ack= 1111
        dataofs= 5L
        reserved= 0L
        flags= PA
        window= 8192
        chksum= 0x27d5
        urgptr= 0
        options= []
###[ SSL/TLS ]###
           \records\
            |###[ TLS Record ]###
            |  content_type= handshake
            |  version= TLS_1_0
            |  length= 0x4
            |###[ TLS Handshake ]###
            |     type= client_hello
            |     length= 0x0

the second packet i create is identical to the first except it has tcp dport=4443, but when i use show2() the SSL layer is replayed by Raw

p2 = Ether()/IP(src="1.2.3.4", dst='4.3.2.1',flags="DF")/TCP(sport=12345, dport=4443, flags="PA", ack=1111, seq=3222)/SSL(records=[TLSRecord()/TLSHandshake()])
p2.show2()

###[ Ethernet ]###
  dst= 00:26:52:ce:5f:49
  src= 34:23:87:20:76:59
  type= IPv4
###[ IP ]###
     version= 4L
     ihl= 5L
     tos= 0x0
     len= 49
     id= 1
     flags= DF
     frag= 0L
     ttl= 64
     proto= tcp
     chksum= 0x30bd
     src= 1.2.3.4
     dst= 4.3.2.1
     \options\
###[ TCP ]###
        sport= 12345
        dport= 4443
        seq= 3222
        ack= 1111
        dataofs= 5L
        reserved= 0L
        flags= PA
        window= 8192
        chksum= 0x1835
        urgptr= 0
        options= []
###[ Raw ]###
           load= '\x16\x03\x01\x00\x04\x01\x00\x00\x00'

the third packet is created with no ssl layer but is on tcp dport=443, when i use show2() the ssl Layer is there and I am not expecting it

p3 = Ether()/IP(src="1.2.3.4", dst='4.3.2.1',flags="DF")/TCP(sport=12345, dport=443, flags="PA", ack=1111, seq=3222)/Raw(load="g\x05ZN`")
p3.show2()


###[ Ethernet ]###
  dst= 00:26:52:ce:5f:49
  src= 34:23:87:20:76:59
  type= IPv4
###[ IP ]###
     version= 4L
     ihl= 5L
     tos= 0x0
     len= 45
     id= 1
     flags= DF
     frag= 0L
     ttl= 64
     proto= tcp
     chksum= 0x30c1
     src= 1.2.3.4
     dst= 4.3.2.1
     \options\
###[ TCP ]###
        sport= 12345
        dport= https
        seq= 3222
        ack= 1111
        dataofs= 5L
        reserved= 0L
        flags= PA
        window= 8192
        chksum= 0x2189
        urgptr= 0
        options= []
###[ SSL/TLS ]###
           \records\
###[ Raw ]###
              load= 'g\x05ZN`'

questions:

how can i craft the packet where the ssl layer appears in different dport other than 443?
why is Raw data appearing in SSL layer where dport = 443
am i stuck using dport 443 for ssl/tls?
am I also stuck on using a !443 dport when not using ssl/tls?

other info possibly related

scapy version 2.3.1

scapy-ssl_ tls-version 1.2.2

installation method manual:

install requirements from requirements.txt
copy scapy_ssl_tls/* to scapy_installation/scapy/layers
modify scapy_installation/scapy/config.py to autoload SSL/TLS

tintin tintin · Accepted Answer · 2016-06-09T08:30:45

bind the ssl layers to your port with bind_layers(TCP, SSL, dport=4443) (also see scapy-ssl_tls bindings) otherwise scapy will not try to dissect your stream as SSL. If you do not want to bind SSL to your dport but only get an unserialized overview of your object use .show() instead of .show2(), this works for any port.
this actually looks like a bug as the ssl dissector is supposed to bail if there is no trace of a valid tlsrecord. please file a bug with the project
no, see 1,2
no, see 2,2