Forum Discussion

KUR_304583's avatar
KUR_304583
Icon for Nimbostratus rankNimbostratus
Mar 09, 2018

SSLDUMP "OpenSSL: decryption enabled." meaning..

I was playing with SSLDUMP in our lab-F5. I tried the Below command to capture some SSL Traffic. "SSLDUMP -r /path/xxx.pcap -i (interface) -dn host x.x.x.x". As a Result I got below message,   "...
.pcap
application delivery
BIG-IP
ssldump
tcpdump
TMSH
Jer-O's avatar
Jer-O
Icon for Cirrus rankCirrus
Apr 19, 2018

I've found it much more useful to do a tcpdump first, then read the pcap file with ssldump. It also gives you more flexibility to analyze the dump with Wireshark as well as convert it through ssldump.

 

tcpdump -vvnni 0.0:nnnp -s0 host ip_address -w /shared/tmp/file.pcap

 

This command captures end-to-end packets that can be traced using the F5 plugin for Wireshark.

 

This is also included in a script I published today.

 

Finally (If you have access to the key):

 

ssldump -Aednr /var/tmp/file.pcap -k /config/filestore/files_d/Common_d/certificate_key_d/:Common:file.key__ > /shared/tmp/file.txt