TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the block size, which in this case is 16 bytes. However when I look at the below output from wireshark, I'm confused. After subtracting the 16 bytes corresponding to the IV from the beginning of the Encrypted Application Data, that leaves 100 bytes of ciphertext which is obviously not a multiple of 16. What am I not understanding?



EDIT: I've included information about the ciphersuite
The default mode of TLS use MAC-then-Encrypt, it compute the tag, append it to the message, and then padd it to have a length multiple of the block size (16 in our case). 
However, you can change the default mode to use Encrypt-then-MAC (which eliminates risks of padding attacks over AES-CBC). In this case, the message is padded and encrypted, and only then you compute the tag and add it at the end.

In your case,  TLS_RSA_WITH_AES_128_CBC_SHA use SHA1, which produce a 20 bytes long tag : 
$$116-20=96=16\times 6$$

That's the only way I have to explain it, but both the server and the client have to implement the option Encrypt-then-MAC.