Use the protocol version from Client Hello, because some clients don't always put the best version in the record layer packets.