Why is tcpdump not capturing TLS packets on port 443?

Asked Aug 06 '18 at 14:10

Active Aug 06 '18 at 14:10

Viewed 2,709 times

I am using the following command:

sudo tcpdump -vvv -A -XX -i any -w dump.pcap

I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able to see the TLS packets sent during the SSL Handshake process. What am I missing?

asked Aug 06 '18 at 14:10

rreyes1979

What makes you think you don't see the SSL Handshake? – RalfFriedl Aug 06 '18 at 17:36
what is your version of tcpdump? – A.B Aug 06 '18 at 18:13
@RalfFriedl I am expecting to see TLS packets like Hello Client or Certificate requests but I am only seeing TCP Packets. – rreyes1979 Aug 06 '18 at 19:49
@A.B tcpdump version 4.9.2, libpcap version 1.7.4, OpenSSL 1.0.2g 1 Mar 2016. – rreyes1979 Aug 06 '18 at 19:50
ok. until 4.0.0 the snaplen was ~ 68 bytes, but now it defaults to 256k (so that shouldn't be that). – A.B Aug 06 '18 at 19:51
tcpdump will only show TCP packets. It doesn't decode TLS packets like Hello Client or Certificate – RalfFriedl Aug 06 '18 at 19:55

Why is tcpdump not capturing TLS packets on port 443?

0 Answers0