Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Bartek's avatar
Bartek
Icon for Cirrus rankCirrus
Jul 20, 2022

Decrypting SSL traffic - PMS and egress

Hi - two questions combined.

Background - trying to catch and decipher tcpdump both for Client -> VIP and F5-> Pool Members traffic 

I'm following this tutorial: Decrypt with tcpdump --f5 ssl

I managed to catch the frontend traffic, but I'm struggling with creating the PMS key. I want to automate it using the provided wireshark cmd command, but I get the error:

C:\Program Files\Wireshark: invalid option -- 'T'
C:\Program Files\Wireshark: invalid option -- 'e'

I'm using Wireshark 3.4.8 - what would be the equivalent options for my version? Unfortunately using a Linux in this environment is out of the question. I can only work on Windows stepping stone and can't send the captures to my PC

Second issue:

Catching the backend traffic does not produce the F5 TLS in the pcap capture... The server ssl profile is present, but I have no idea how to force the --f5 ssl option in tcpdump to catch the keys. 

Will appreciate any advice - It is my second day struggling with the issue

14 Replies

No RepliesBe the first to reply