Smarter by Design.Simpler for Business
sys-cmd ssldump
sys-cmd ssldump listens to the TLS traffic passing through the route table selected in WEB-CLI and writes the handshake messages of every connection by analyzing them in order: the cipher suites that the client offers, the TLS version and the cipher suite that the server selects, the certificate messages and the alerts. It is used to see at which step a TLS connection breaks.
Command Summary
# type ssldump and press Tab: a free parameter
admin@TR7LBWAF01> sys-cmd ssldump
<ssldump-parameter-1>
admin@TR7LBWAF01> sys-cmd ssldump <parameters> <filter>
admin@TR7LBWAF01>
Everything written after the word ssldump is passed to the tool as it is. There is no mandatory field; the filter expressions are written in the same form as with tcpdump.
How It Works
| Subject | Behavior |
|---|---|
| Context | It listens to the interfaces of the selected v-device and route table. |
| Triggering | Only the TLS connections that start while the command is running are analyzed; for this reason, the relevant connection must be established after the command is started. |
| Duration | It listens without stopping; it is stopped with Ctrl+C. |
| Pipe | The output can be filtered with | or written to a file with to-file. |
| Recording | Every run is written to the user logs. |
Frequently Used Parameters
| Parameter | What it does | What is written after it |
|---|---|---|
-i | Selects the interface to be listened to; any listens to all the interfaces | An interface name or any |
-n | Does not resolve the addresses to names | — |
-A | Writes all the fields of the messages | — |
-e | Adds a timestamp to every line | — |
| Filter | Determines which connections will be listened to | host 10.20.0.30 and port 8443 |
The table summarizes the frequently used ones; the full list depends on the version of the tool on the device.
Examples
admin@TR7LBWAF01> sys-cmd ssldump -n -i any host 10.0.7.20 and port 443
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd ssldump -n -i any host 10.20.0.30 and port 8443
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd ssldump -n -e -A -i any host 10.0.7.20 and port 443
admin@TR7LBWAF01>
Things to Know
- TLS 1.3. In this version the handshake messages after the first response of the server go encrypted; only the first messages and the encrypted records appear in the output.
- A connection is needed. While the command is running, the connection to be followed must be started on the client side; for example by entering the site again from the browser.
- For the supported versions and the certificate,
sslscan, which scans the target directly instead of following a connection, gives a faster result. - The application data stays encrypted; this command does not open the content of the traffic.
