Forum Discussion

MDPF52_180608's avatar
MDPF52_180608
Icon for Nimbostratus rankNimbostratus
Jul 27, 2015

SSLDump ServerSide

Hello Devcentral,

 

I want to ask you how I can examine the SSL traffic between the BIG IP and the backend server.

 

The scenario is the following:

 

Client 1. <--SSL--> 2. (offloading) BIGIP (new ssl tunnel) 3. <---SSL---> 4. Backend

 

I need to analyze the traffic in point 3. ( at the moment I'm using the following server ssl profile: ssl-insecure-compatible.

 

Thanks in advance,

 

Best regards,

 

M.

 

application delivery
deployment
LTM
performance
security

3 Replies

Sort By
  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Jul 27, 2015

    You will need to decrypt the traffic using the key from the backend server. If you move the key from the backend to the bigip you can use ssldump to create the PMS file used in wireshark to analyze the data.

     

    You also need to make sure you get the ssl handshake for the pms process to work so if you have OneConnect configured I would recommend turning it off while testing.

     

    Seth

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 27, 2015

    Here's what that ssldump command should look like (once you've imported the server's SSL private key):

    ssldump -k [path to server's private key] -AdNn -i 0.0 port 443 and host [IP of server]

    As Seth mentioned, you definitely want to turn off OneConnect while testing because ssldump needs to be able to see the original SSL handshake. This command will dump all of the cleartext data to the command line.

  • StephanManthey's avatar
    StephanManthey
    Icon for MVP rankMVP
    Nov 22, 2017

    On BIG-IP VE TMOS v12.1.2 I tested a different approach:

    A "frontend" virtual server terminates SSL by using a client-ssl profile but does not re-encrypt (no server-ssl profile assigned).

    Instead the "frontend" virtual server has an iRule (please see below) to forward traffic to a 2nd "internal" virtual server on the same BIG-IP device (no pool assigned): 
    when CLIENTSSL_HANDSHAKE {
    virtual vs_internal
}

    The "internal" virtual server will re-encrypt by using a server-ssl profile to the pool of real servers. The tcpdump will target the interface "

    0.0:nnn
    " (capturing "F5 internal noise" to be decoded by the F5 wireshark plugin) and filters on the "internal" virtual servers IP address.

    Please make sure to capture the whole packet "
    -s 0
    " into the raw dump file specified by "
    -w
    " and limit the number of packets i.e "
    -c 10000
    ": 
    tcpdump -i 0.0:nnn -s 0 -c 10000 -w /var/tmp/internal.001.pcap host