Forum Discussion

Bartek's avatar
Bartek
Icon for Cirrus rankCirrus
Jul 20, 2022

Decrypting SSL traffic - PMS and egress

Hi - two questions combined. Background - trying to catch and decipher tcpdump both for Client -> VIP and F5-> Pool Members traffic  I'm following this tutorial: Decrypt with tcpdump --f5 ssl I ma...
application delivery
LTM
PMS
ssl
tcpdump
tls
CA_Valli's avatar
CA_Valli
Icon for MVP rankMVP
Jul 20, 2022

Hello, I usually use an iRule to log and collect secrets which I'm attaching. This saves info in plain text in LTM file, eventually you can force log rotation and manually bulk-delete all lines from this iRule in "ltm.1" file when you're done.

To retrieve info and create pms file, run this from bash shell. 

 

sed -e 's/^.*\(RSA Session-ID\)/\1/;tx;d;:x' /var/log/ltm > /var/tmp/sessionsecrets.pms
grep -h -o 'CLIENT_RANDOM.*' /var/log/ltm >> /var/tmp/sessionsecrets.pms

 

 To import PMS file in wireshark, 

Edit -> Preferences -> Protocols -> SSL => (Pre)-Master Secret log filename [Browse]