Re: [tcpdump-workers] libpcap and certificates

2011-10-05 Thread Geoffrey Sisson
"Geoffrey Sisson" wrote: >N.B. the last > change in the change log is 2002, so there's a possibility of bit rot. Actually the SourceForge repository has more recent activity: http://sourceforge.net/projects/ssldump/develop Geoff - This i

Re: [tcpdump-workers] libpcap and certificates

2011-10-05 Thread Geoffrey Sisson
Aaron Turner wrote: > Last I checked, tcpdump supports decrypting IPSec, but not SSL. > However, Wireshark decrypts SSL. You'll need the SSL private key of > the webserver to do it. There's also ssldump, written by Eric Rescorla (RFC 5246 co-author): http://www.rtfm.com/ssldump/ I used ss

Re: [tcpdump-workers] libpcap and certificates

2011-10-05 Thread Peter Volkov
В Чтв, 06/10/2011 в 02:06 +0900, Andrej van der Zee пишет: > Yes i am aware Wireshark can do it if you provide the private key, but > i need to decrypt packets in my own sniffer based on libpcap. I was > hoping i am not the first and somebody could gimme some startup > pointers, so that i dont have

Re: [tcpdump-workers] libpcap and certificates

2011-10-05 Thread Andrej van der Zee
>> I would like to ask if somebody could point me to information on howto >> hook up libpcap to sniff a secure website on HTTPS. I understand I >> have to decrypt the packets probably using openssl, but I wonder if >> there is some howto to guide me. I am on the latest Ubuntu. > > Last I checked,

Re: [tcpdump-workers] libpcap and certificates

2011-10-05 Thread Aaron Turner
On Wed, Oct 5, 2011 at 4:15 AM, Andrej van der Zee wrote: > Hi, > > I would like to ask if somebody could point me to information on howto > hook up libpcap to sniff a secure website on HTTPS. I understand I > have to decrypt the packets probably using openssl, but I wonder if > there is some howt

[tcpdump-workers] odd behavior of telnet server

2011-10-05 Thread Martin T
Hello, I have a radio device which supports management over telnet. However, it supports only one telnet session at a time. If I do "hping -S -p 23 -i 5 -I fxp0 10.10.10.1"(send TCP SYN packet to port 23 of 10.10.10.1 after every 5 seconds over interface fxp0) I get following tcpdump output: 17:08

[tcpdump-workers] libpcap and certificates

2011-10-05 Thread Andrej van der Zee
Hi, I would like to ask if somebody could point me to information on howto hook up libpcap to sniff a secure website on HTTPS. I understand I have to decrypt the packets probably using openssl, but I wonder if there is some howto to guide me. I am on the latest Ubuntu. Cheers, Andrej - This is th