CentOS6 64bit : install ssldump 0.9b3

# cat /etc/centos-release CentOS release 6.3 (Final) # uname -ri 2.6.32-279.2.1.el6.x86_64 x86_64

# wget ftp.scientificlinux.org/linux/scientific/6.0/x86_64/os/Packages/epel-release-6-5.noarch.rpm # rpm -ivh epel-release-6-5.noarch.rpm # yum update -y # yum install ssldump # ssldump -v ssldump 0.9b3 Copyright (C) 1998-2001 RTFM, Inc. All rights reserved. Compiled with OpenSSL: decryption enabled

# ssldump -i eth0 port 443 New TCP connection #1: 192.168.10.15(44718) <-> 192.168.10.35(443) 1 1  0.0008 (0.0008)  C>S  Handshake      ClientHello        Version 3.1        cipher suites        Unknown value 0xc014        Unknown value 0xc00a        TLS_DHE_RSA_WITH_AES_256_CBC_SHA        TLS_DHE_DSS_WITH_AES_256_CBC_SHA        Unknown value 0x88        Unknown value 0x87        Unknown value 0xc00f        Unknown value 0xc005        TLS_RSA_WITH_AES_256_CBC_SHA        Unknown value 0x84        Unknown value 0xc012        Unknown value 0xc008        TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA        Unknown value 0xc00d        Unknown value 0xc003        TLS_RSA_WITH_3DES_EDE_CBC_SHA        Unknown value 0xc013        Unknown value 0xc009        TLS_DHE_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_DSS_WITH_AES_128_CBC_SHA        Unknown value 0x9a        Unknown value 0x99        Unknown value 0x45        Unknown value 0x44        Unknown value 0xc00e        Unknown value 0xc004        TLS_RSA_WITH_AES_128_CBC_SHA        Unknown value 0x96        Unknown value 0x41        Unknown value 0xc011        Unknown value 0xc007        Unknown value 0xc00c        Unknown value 0xc002        TLS_RSA_WITH_RC4_128_SHA        TLS_RSA_WITH_RC4_128_MD5        TLS_DHE_RSA_WITH_DES_CBC_SHA        TLS_DHE_DSS_WITH_DES_CBC_SHA        TLS_RSA_WITH_DES_CBC_SHA        TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA        TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA        TLS_RSA_EXPORT_WITH_DES40_CBC_SHA        TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5        TLS_RSA_EXPORT_WITH_RC4_40_MD5        Unknown value 0xff        compression methods        1 2  0.0010 (0.0001)  S>C  Handshake      ServerHello        Version 3.1        session_id[32]=          de a8 c3 01 a5 8b 81 63 c4 bd 39 b5 0b 25 bc 26          b5 8c 0d 91 cf e4 54 68 3b 3c cd 1c 62 de 0e f0        cipherSuite         TLS_RSA_WITH_RC4_128_SHA        compressionMethod                   NULL 1 3  0.0010 (0.0000)  S>C  Handshake      Certificate 1 4  0.0010 (0.0000)  S>C  Handshake      ServerHelloDone 1 5  0.0026 (0.0016)  C>S  Handshake      ClientKeyExchange 1 6  0.0026 (0.0000)  C>S  ChangeCipherSpec 1 7  0.0026 (0.0000)  C>S  Handshake 1 8  0.0062 (0.0036)  S>C  ChangeCipherSpec 1 9  0.0062 (0.0000)  S>C  Handshake 1 10 0.0071 (0.0008)  C>S  application_data 1 11 0.0157 (0.0085)  S>C  application_data 1    0.0172 (0.0014)  C>S  TCP FIN 1    0.0172 (0.0000)  S>C  TCP FIN

decrypt SSL traffic using a private key.

# ssldump -i eth0 -Ad -k test-ssl.private -i eth0 New TCP connection #1: 192.168.10.15(44721) <-> 192.168.10.35(443) 1 1  0.0009 (0.0009)  C>S V3.1(204)  Handshake      ClientHello        Version 3.1        random[32]=          50 29 e1 75 3f d7 ae 0e 1e a7 fb 56 71 3d ea 0a          f5 2d d6 e6 b6 1a 71 4c 86 6c 93 ab 16 4b 0e 4d        cipher suites        Unknown value 0xc014        Unknown value 0xc00a        TLS_DHE_RSA_WITH_AES_256_CBC_SHA        TLS_DHE_DSS_WITH_AES_256_CBC_SHA        Unknown value 0x88        Unknown value 0x87        Unknown value 0xc00f        Unknown value 0xc005        TLS_RSA_WITH_AES_256_CBC_SHA        Unknown value 0x84        Unknown value 0xc012        Unknown value 0xc008        TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA        Unknown value 0xc00d        Unknown value 0xc003        TLS_RSA_WITH_3DES_EDE_CBC_SHA        Unknown value 0xc013        Unknown value 0xc009        TLS_DHE_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_DSS_WITH_AES_128_CBC_SHA        Unknown value 0x9a        Unknown value 0x99        Unknown value 0x45        Unknown value 0x44        Unknown value 0xc00e        Unknown value 0xc004        TLS_RSA_WITH_AES_128_CBC_SHA        Unknown value 0x96        Unknown value 0x41        Unknown value 0xc011        Unknown value 0xc007        Unknown value 0xc00c        Unknown value 0xc002        TLS_RSA_WITH_RC4_128_SHA        TLS_RSA_WITH_RC4_128_MD5        TLS_DHE_RSA_WITH_DES_CBC_SHA        TLS_DHE_DSS_WITH_DES_CBC_SHA        TLS_RSA_WITH_DES_CBC_SHA        TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA        TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA        TLS_RSA_EXPORT_WITH_DES40_CBC_SHA        TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5        TLS_RSA_EXPORT_WITH_RC4_40_MD5        Unknown value 0xff        compression methods        1 2  0.0011 (0.0002)  S>C V3.1(81)  Handshake      ServerHello        Version 3.1        random[32]=          50 29 e1 72 d3 eb 0c b0 88 a0 95 91 23 7c 59 61          0b 0a 00 28 6d 9a e9 7e 83 40 32 7f c9 97 be 25        session_id[32]=          e7 30 e6 d2 8e 15 77 b1 e0 d0 46 d6 d8 05 e1 11          71 35 60 c2 a6 58 45 0a e9 22 5a fb 29 1b c4 80        cipherSuite         TLS_RSA_WITH_RC4_128_SHA        compressionMethod                   NULL 1 3  0.0011 (0.0000)  S>C V3.1(799)  Handshake      Certificate 1 4  0.0011 (0.0000)  S>C V3.1(4)  Handshake      ServerHelloDone 1 5  0.0027 (0.0015)  C>S V3.1(262)  Handshake      ClientKeyExchange        EncryptedPreMasterSecret[256]=          57 e2 4f 1c 95 5d fe b8 5a 8e 30 18 b8 e8 68 38          84 c2 65 d6 98 64 45 bd 38 42 6d e0 79 cb 7a 40          f9 c3 65 00 4a 63 b0 9d dd 01 b5 89 43 d2 2d 68          dd b8 93 02 d2 15 9e 5c 6c 0c 8e 70 4a cb 06 1f          eb 26 40 1c 46 cb d0 43 2e c5 77 59 06 23 2d c5          85 72 9c 5a eb 41 d0 0d 2a a3 52 da 09 0d 39 cb          dd ad 1a ca 43 ba 49 be 5e a9 52 53 43 c7 9d 13          3d 5d 47 ff ca 5e ff ab 70 87 eb 52 15 6f d1 f9          18 af 25 f9 5a bd f9 62 31 71 61 54 9d b0 ed d7          8d ee e5 aa a0 45 c0 de 7c 9d 22 85 4c 1c 41 ba          60 16 ff 5b 1f 2a 84 3c fd 27 e9 5f 8a fa 19 95          e7 ef ff d8 52 dd c8 73 7b 18 64 65 e9 54 13 92          65 45 1b eb 7a cd 24 bb 0e 8d 10 77 c4 5c ee 9a          92 b8 dc 70 81 bb 2e 44 04 b4 a9 76 43 f6 c6 fc          bd 69 05 11 21 52 5b 5b 12 3d 32 18 d1 6f d6 20          98 57 f1 e6 8c f8 a3 60 3e 4b 89 82 96 e2 6e 6b 1 6  0.0027 (0.0000)  C>S V3.1(1)  ChangeCipherSpec 1 7  0.0027 (0.0000)  C>S V3.1(36)  Handshake      Finished        verify_data[12]=          b2 7c 53 3f e5 03 85 e0 43 96 a1 a9 1 8  0.0060 (0.0033)  S>C V3.1(1)  ChangeCipherSpec 1 9  0.0060 (0.0000)  S>C V3.1(36)  Handshake      Finished        verify_data[12]=          9b cd b0 1a 42 8f e4 a5 40 cf 65 8e 1 10 0.0071 (0.0010)  C>S V3.1(131)  application_data    ---------------------------------------------------------------    GET / HTTP/1.0    User-Agent: Wget/1.12 (linux-gnu)    Accept: */*    Host: 192.168.10.35    Connection: Keep-Alive    --------------------------------------------------------------- 1 11 0.0141 (0.0069)  S>C V3.1(447)  application_data    ---------------------------------------------------------------    HTTP/1.1 200 OK    Server: Apache/2.2.15 (CentOS)    Content-Type: text/html; charset=UTF-8    Date: Tue, 14 Aug 2012 05:26:11 GMT    Accept-Ranges: bytes    ETag: "400c9-a-4c037d8b92dd1"    Connection: Keep-Alive    Set-Cookie: X-Mapping-eiakmicn=17EDFFA1AF4047596F35E5829DF54440; path=/    Set-Cookie: X-Mapping-eiakmicn=17EDFFA1AF4047596F35E5829DF54440; path=/    Last-Modified: Thu, 17 May 2012 09:13:18 GMT    Content-Length: 10    centos6-4    --------------------------------------------------------------- 1    0.0160 (0.0018)  C>S  TCP FIN 1    0.0161 (0.0000)  S>C  TCP FIN

In case of Ubuntu / Mint , you can install it via apt-get , however it seems that there is a bug.

# apt-get install –y ssldump # apt-cache policy ssldump ssldump:  Installed: 0.9b3-4.1  Candidate: 0.9b3-4.1  Version table: *** 0.9b3-4.1 0        500 http://jp.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages        100 /var/lib/dpkg/status # ssldump  -v ssldump 0.9b3 Copyright (C) 1998-2001 RTFM, Inc. All rights reserved

nnn , decryption is not enabled…

- ssldump bug

ssldump does not decrypt traffic https://bugs.launchpad.net/ubuntu/+source/ssldump/+bug/1003620

In case of Fedora , you can install it via yum without adding an extra repo.

[root@fc17-note ~]# yum install -y ssldump [root@fc17-note ~]# ssldump -v ssldump 0.9b3 Copyright (C) 1998-2001 RTFM, Inc. All rights reserved. Compiled with OpenSSL: decryption enabled