Wireshark to view HTTPS traffic

If there is a server-side certificate, then we can analyze the Web under the HTTPS communication situation, in particular scenarios have certain uses, such as external audit

The following is the configuration of the view HTTPS setting in Wireshark or Tshark

Wireshark Verification

Tshark Verification

Tshark-f "TCP and port 443"-I Eth2-o "SSL.KEYS_LIST:192.168.0.155,443,HTTP,/ROOT/TMP/A.CRT"

15.852877 192.168.0.155, 192.168.0.55 TCP-HTTPS > Sia-ctrl-plane [ACK] seq=1 ack=132 win=6912 len=0

15.854385 192.168.0.155-192.168.0.55 TLSv1 722 server Hello, Certificate, server Hello Done

15.854813 192.168.0.55-192.168.0.155 TLSv1 252 Client Key Exchange, change Cipher Spec, finished

15.857471 192.168.0.155, 192.168.0.55 TLSv1 change Cipher Spec

15.857721 192.168.0.155, 192.168.0.55 TLSv1 107 finished

15.857811 192.168.0.55-192.168.0.155 TCP sia-ctrl-plane > HTTPS [ACK] seq=330 ack=728 win=64972 len=0

15.859990 192.168.0.55-192.168.0.155 SSL 731 [SSL segment of a reassembled PDU]

15.899431 192.168.0.155, 192.168.0.55 TCP-HTTPS > Sia-ctrl-plane [ACK] seq=728 ack=1007 win=9344 len=0

15.902726 192.168.0.55-192.168.0.155 TCP xmcp > HTTPS [SYN] seq=0 win=8192 len=0 mss=1460 ws=4 sack_perm=1

15.902774 192.168.0.155, 192.168.0.55 TCP, HTTPS > XMCP [SYN, ACK] seq=0 ack=1 win=5840 len=0 mss=1460 sack_perm =1 ws=64

15.902887 192.168.0.55-192.168.0.155 TCP xmcp > HTTPS [RST] seq=1 win=0 len=0

15.909868 192.168.0.55-192.168.0.155 TCP 4789 > HTTPS [SYN] seq=0 win=8192 len=0 mss=1460 ws=4 sack_perm=1

15.909912 192.168.0.155, 192.168.0.55 TCP, HTTPS > 4789 [SYN, ACK] seq=0 ack=1 win=5840 len=0 mss=1460 sack_perm =1 ws=64

15.910026 192.168.0.55-192.168.0.155 TCP 4789 > HTTPS [RST] seq=1 win=0 len=0

15.921205 192.168.0.55-192.168.0.155 TCP 4790 > HTTPS [SYN] seq=0 win=8192 len=0 mss=1460 ws=4 sack_perm=1

15.921250 192.168.0.155, 192.168.0.55 TCP, HTTPS > 4790 [SYN, ACK] seq=0 ack=1 win=5840 len=0 mss=1460 sack_perm =1 ws=64

15.921359 192.168.0.55-192.168.0.155 TCP 4790 > HTTPS [RST] seq=1 win=0 len=0

15.930390 192.168.0.55-192.168.0.155 TCP 4791 > HTTPS [SYN] seq=0 win=8192 len=0 mss=1460 ws=4 sack_perm=1

15.930422 192.168.0.155, 192.168.0.55 TCP, HTTPS > 4791 [SYN, ACK] seq=0 ack=1 win=5840 len=0 mss=1460 sack_perm =1 ws=64

15.930532 192.168.0.55-192.168.0.155 TCP 4791 > HTTPS [RST] seq=1 win=0 len=0

15.991719 192.168.0.55-192.168.0.155 HTTP 107 post/all/rptsave http/1.1 (application/x-www-form-urlencoded)

309 15.991837 192.168.0.155-192.168.0.55 TCP-HTTPS > Sia-ctrl-plane [ACK] seq=728 ack=1060 win=9344 len=0

15.995828 192.168.0.155-192.168.0.55 HTTP 251 http/1.1 OK (text/html)

View the information of the certificate, Asn1view This tool is very useful

Wireshark to view HTTPS traffic