Forum Discussion
NimbostratusWireshark Plugin for TLS
I am currently running Wireshark 4.4.6 and option for F5 TLS in Analyze > Enabled Protocols is missing. I have been trying to locate plugins to install but not having any luck. The problem is when I do captures encrypted traffic, the TLS info is missing, and I am unable to locate keylog data to decrypt. Do anyone know any plugin locations or alternative steps to decrypt without using the irule option?
tcpdump -nn -s0 -i 0.0:nnnp -w /shared/tmp/Cxxxx_tcpdump_12_Jun_05_59_40_F05.com.pcap --f5 ssl host XXX.XXX.XXX.XXX
1 Reply
f51Cumulonimbus
Hi worthyt98 ,
Check the following link. As per below article - Wireshark 2.6 and greater have the F5 ethtrailer plugin already installed. You will have to update one setting in Wireshark to get it fully working:
https://clouddocs.f5.com/training/community/adc/html/class4/module1/lab04.html
Getting Started with the F5 Wireshark Plugin on Windows | DevCentral
Alternatively, you can use SSL debug logging
References:
- K31793632: Creating a decrypted tcpdump capture without using an iRule
- K50557518: Decrypting SSL/TLS traffic using session keys generated by the BIG-IP system
