Re: libpcap and certificates

["Geoffrey Sisson" <geoff () geoff co uk>]

Aaron Turner <synfinatic () gmail com> wrote:

> Last I checked, tcpdump supports decrypting IPSec, but not SSL.
> However, Wireshark decrypts SSL.  You'll need the SSL private key of
> the webserver to do it.

There's also ssldump, written by Eric Rescorla (RFC 5246 co-author):

    http://www.rtfm.com/ssldump/

I used ssldump on a few projects a few years ago.  N.B. the last
change in the change log is 2002, so there's a possibility of bit rot.

Geoff
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.