Packet & TLS Analysis

The Packet & TLS Analysis group gathers the three commands that show the traffic at the packet level and analyze the TLS connections. The questions "Is a request coming to the VIP, is a response returning from the backend?", "Where does the TLS handshake break?", "Which TLS versions and which certificate does the server offer?" are the job of this group.

tcpdump

It follows the packets live or writes them to a pcap file.

→

ssldump

It analyzes the handshake messages in order in the flowing TLS traffic.

→

sslscan

It connects to the target and lists the supported TLS versions, the cipher suites and the certificate.

→

Which Command When?

Question	Command	Example
Is a packet going to and coming from the VIP or the backend?	tcpdump	sys-cmd tcpdump -nn -i any -c 50 host 10.20.0.30
Taking a file in order to examine the traffic in Wireshark	tcpdump	sys-cmd tcpdump -nn -i any -c 500 port 443 | to-file vip-443.pcap
At which step is the TLS handshake cut?	ssldump	sys-cmd ssldump -n -i any host 10.20.0.30 and port 8443
Which TLS versions and cipher suites does the server accept?	sslscan	sys-cmd sslscan 10.0.7.20:443
Which certificate is offered, and when does it expire?	sslscan	sys-cmd sslscan --show-certificate --no-ciphersuites 10.0.7.20:443

Common Behavior

Subject	Behavior
Writing	All three are tools with free parameters: everything written after the command name is passed to the tool as it is.
Context	tcpdump and ssldump see the traffic passing through the interfaces of the selected v-device and route table; sslscan connects to the target from that route table.
File	The packets are written to a file only with | to-file <name>; in the tcpdump command -w and -r are rejected. The files are downloaded and deleted with the file commands.
Duration	tcpdump and ssldump listen without stopping; they are stopped with -c or with Ctrl+C. sslscan closes when the scan finishes.
Recording	Every run is written to the user logs.

All of the writing rules and the restrictions: System Commands.