2

On a device located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet.

So I'm trying to figure out how to get the proper filter with tcpdump.

I found help from this paper : http://www.wains.be/pub/networking/tcpdump_advanced_filters.txt It explains how to use advance filter on IP and TCP fields.

I try this kind of filter :

tcpdump -i any 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -A -s 0 -v | grep 'Host\|id-at-commonName='

As explained in the paper, "We are matching any packet that contains data."

It works for Host field as for many other data, but I can't match the field id-at-commonName= which is in SSL field (so in the TCP Data field ?).

To be sure I captured a pcap file with the exact same filter (without the grep) and when I open it with Wireshark, I can read every Certificate Common name.

I must use a tcpdump filter because I need to get the data "on the fly".

Can someone tell why I can't see those data through tcpdump ?

  • Not sure if you're aware but you can use tshark which is wireshark's command line interface to do similar things as tcpdump. Perhaps you could use that instead? – slm Feb 12 '14 at 2:22
  • I'd like to use it but I'm limited by the fact it is a proprietary device on which I can't use other tool than tcpdump .. – Kuruwan Feb 12 '14 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.