On a device located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet.
So I'm trying to figure out how to get the proper filter with tcpdump.
I found help from this paper : http://www.wains.be/pub/networking/tcpdump_advanced_filters.txt It explains how to use advance filter on IP and TCP fields.
I try this kind of filter :
tcpdump -i any 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -A -s 0 -v | grep 'Host\|id-at-commonName='
As explained in the paper, "We are matching any packet that contains data."
It works for Host field as for many other data, but I can't match the field id-at-commonName=
which is in SSL field (so in the TCP Data field ?).
To be sure I captured a pcap file with the exact same filter (without the grep) and when I open it with Wireshark, I can read every Certificate Common name.
I must use a tcpdump filter because I need to get the data "on the fly".
Can someone tell why I can't see those data through tcpdump ?
tshark
which is wireshark's command line interface to do similar things as tcpdump. Perhaps you could use that instead?