Decrypting SSL traffic - PMS and egress
Hi - two questions combined.
Background - trying to catch and decipher tcpdump both for Client -> VIP and F5-> Pool Members traffic
I'm following this tutorial: Decrypt with tcpdump --f5 ssl
I managed to catch the frontend traffic, but I'm struggling with creating the PMS key. I want to automate it using the provided wireshark cmd command, but I get the error:
C:\Program Files\Wireshark: invalid option -- 'T'
C:\Program Files\Wireshark: invalid option -- 'e'
I'm using Wireshark 3.4.8 - what would be the equivalent options for my version? Unfortunately using a Linux in this environment is out of the question. I can only work on Windows stepping stone and can't send the captures to my PC
Second issue:
Catching the backend traffic does not produce the F5 TLS in the pcap capture... The server ssl profile is present, but I have no idea how to force the --f5 ssl option in tcpdump to catch the keys.
Will appreciate any advice - It is my second day struggling with the issue