diff --git a/src/SimpleClient.hs b/src/SimpleClient.hs
--- a/src/SimpleClient.hs
+++ b/src/SimpleClient.hs
@@ -35,7 +35,7 @@
     , cipher_RC4_128_SHA1
     ]
 
-runTLS debug params hostname portNumber f = do
+runTLS debug ioDebug params hostname portNumber f = do
     rng  <- RNG.makeSystem
     he   <- getHostByName hostname
     sock <- socket AF_INET Stream defaultProtocol
@@ -43,13 +43,20 @@
     E.catch (connect sock sockaddr)
           (\(e :: SomeException) -> sClose sock >> error ("cannot open socket " ++ show sockaddr ++ " " ++ show e))
     ctx <- contextNew sock params rng
-    contextHookSetLogging ctx logging
+    contextHookSetLogging ctx getLogging
     () <- f ctx
     sClose sock
-  where logging = if not debug then def else def
-                { loggingPacketSent = putStrLn . ("debug: >> " ++)
-                , loggingPacketRecv = putStrLn . ("debug: << " ++)
-                }
+  where getLogging = ioLogging $ packetLogging $ def
+        packetLogging logging
+            | debug = logging { loggingPacketSent = putStrLn . ("debug: >> " ++)
+                              , loggingPacketRecv = putStrLn . ("debug: << " ++)
+                              }
+            | otherwise = logging
+        ioLogging logging
+            | ioDebug = logging { loggingIOSent = putStrLn . ("io: >> " ++) . show
+                                , loggingIORecv = \hdr -> putStrLn . (("io: << " ++ show hdr ++ " ") ++) . show
+                                }
+            | otherwise = logging
 
 sessionRef ref = SessionManager
     { sessionEstablish  = \sid sdata -> writeIORef ref (sid,sdata)
@@ -81,11 +88,11 @@
                 | otherwise          = TLS12
             supportedVers
                 | NoVersionDowngrade `elem` flags = [tlsConnectVer]
-                | otherwise = filter (< tlsConnectVer) allVers
+                | otherwise = filter (<= tlsConnectVer) allVers
             allVers = [SSL3, TLS10, TLS11, TLS12]
             validateCert = not (NoValidateCert `elem` flags)
 
-data Flag = Verbose | Debug | NoValidateCert | Session | Http11
+data Flag = Verbose | Debug | IODebug | NoValidateCert | Session | Http11
           | Ssl3 | Tls10 | Tls11 | Tls12
           | NoSNI
           | Uri String
@@ -99,6 +106,7 @@
 options =
     [ Option ['v']  ["verbose"] (NoArg Verbose) "verbose output on stdout"
     , Option ['d']  ["debug"]   (NoArg Debug) "TLS debug output on stdout"
+    , Option []     ["io-debug"] (NoArg IODebug) "TLS IO debug output on stdout"
     , Option ['s']  ["session"] (NoArg Session) "try to resume a session"
     , Option ['O']  ["output"]  (ReqArg Output "stdout") "output "
     , Option []     ["no-validation"] (NoArg NoValidateCert) "disable certificate validation"
@@ -106,7 +114,7 @@
     , Option []     ["ssl3"]    (NoArg Ssl3) "use SSL 3.0"
     , Option []     ["no-sni"]  (NoArg NoSNI) "don't use server name indication"
     , Option []     ["user-agent"] (ReqArg UserAgent "user-agent") "use a user agent"
-    , Option []     ["tls10"]   (NoArg Tls11) "use TLS 1.0"
+    , Option []     ["tls10"]   (NoArg Tls10) "use TLS 1.0"
     , Option []     ["tls11"]   (NoArg Tls11) "use TLS 1.1"
     , Option []     ["tls12"]   (NoArg Tls12) "use TLS 1.2 (default)"
     , Option ['x']  ["no-version-downgrade"] (NoArg NoVersionDowngrade) "do not allow version downgrade"
@@ -128,7 +136,9 @@
                         ++ "\r\n\r\n")
             when (Verbose `elem` flags) (putStrLn "sending query:" >> LC.putStrLn query >> putStrLn "")
             out <- maybe (return stdout) (flip openFile WriteMode) getOutput
-            runTLS (Debug `elem` flags) (getDefaultParams flags hostname certStore sStorage sess) hostname port $ \ctx -> do
+            runTLS (Debug `elem` flags)
+                   (IODebug `elem` flags)
+                   (getDefaultParams flags hostname certStore sStorage sess) hostname port $ \ctx -> do
                 handshake ctx
                 sendData ctx $ query
                 loopRecv out ctx
diff --git a/tls-debug.cabal b/tls-debug.cabal
--- a/tls-debug.cabal
+++ b/tls-debug.cabal
@@ -1,5 +1,5 @@
 Name:                tls-debug
-Version:             0.3.1
+Version:             0.3.2
 Description:
    A set of program to test and debug various aspect of the TLS package.
    .