# VS on https , how can i decrypt the traffic - tcpdump taken

**URL:** <https://community.f5.com/t/vs-on-https-how-can-i-decrypt-the-traffic-tcpdump-taken/47490>\
**Category:** Technical Forums\
**Tags:** big-ip, application-delivery\
**Created:** [August 17, 2021, 3:43am UTC](https://community.f5.com/t/vs-on-https-how-can-i-decrypt-the-traffic-tcpdump-taken/47490 "2021-08-17T03:43:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gajji](https://avatars.discourse-cdn.com/v4/letter/g/958977/32.png) [@Gajji](https://community.f5.com/u/Gajji)\
**Post date:** [August 17, 2021, 3:43am UTC](https://community.f5.com/t/vs-on-https-how-can-i-decrypt-the-traffic-tcpdump-taken/47490/1 "2021-08-17T03:43:02Z")

</div>

VS on https , how can i decrypt the traffic - tcpdump taken

If i want to see some mobile number on transaction how do i check whether request hits and pass throught LB

---

<div class="post-metadata">

**Author:** ![Mayur\_Sutare](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/mayur_sutare/32/5035_2.png) [@Mayur\_Sutare](https://community.f5.com/u/Mayur_Sutare)\
**Post date:** [August 17, 2021, 5:57am UTC](https://community.f5.com/t/vs-on-https-how-can-i-decrypt-the-traffic-tcpdump-taken/47490/2 "2021-08-17T05:57:02Z")

</div>

Hi &nbsp;If you have SSL offloading done on F5 vServer i.e. client SSL configured, then F5 can decrypt the traffic and re-encrypt it if required while forwarding it to the pool members. If you want to see the

connections/hits passing through the F5 then there are several ways like-

1. seeing active server and/or client side connections using cli command **show sys connection xx**
2. Seeing hits on the vServer and backend pool members
3. logging required requests traffic using iRule
4. tcpdump etc.

---

<div class="post-metadata">

**Author:** ![Gajji](https://avatars.discourse-cdn.com/v4/letter/g/958977/32.png) [@Gajji](https://community.f5.com/u/Gajji)\
**Post date:** [August 17, 2021, 6:20am UTC](https://community.f5.com/t/vs-on-https-how-can-i-decrypt-the-traffic-tcpdump-taken/47490/3 "2021-08-17T06:20:11Z")

</div>

How do I read the traffic .. ex. Phone number i want to see from client going to server

---

<div class="post-metadata">

**Author:** ![Yiğit\_Uslu](https://avatars.discourse-cdn.com/v4/letter/y/7ab992/32.png) [@Yiğit\_Uslu](https://community.f5.com/u/Yi%C4%9Fit_Uslu)\
**Post date:** [August 22, 2021, 10:11am UTC](https://community.f5.com/t/vs-on-https-how-can-i-decrypt-the-traffic-tcpdump-taken/47490/4 "2021-08-22T10:11:34Z")

</div>

Hi

ssldump -r /path/to/capture\_file -k /path/to/private\_key -M /path/to/pre-master-key\_log\_file

check out details on: [myF5](https://support.f5.com/csp/article/K10209)