Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How can I filter https when monitoring traffic with Wireshark?

I want to verify that the analytics package I've added to my iOS app is attempting to talk to the analytics servers (which I don't control). I think the analytics package is communicating via HTTPS. So I'd like to monitor HTTPS traffic (I don't care about decrypting it... I just want to see if it's there).

How can I do this with Wireshark? For example my current Wireshark setup (which is just a default setup) allows me to monitor traffic to http://www.duckduckgo.com but not https://www.duckduckgo.com. Do I need to change some settings in Wireshark?

Thanks!

share|improve this question
add comment

marked as duplicate by Zoredache, Mark Henderson Aug 23 '11 at 23:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers

up vote 3 down vote accepted

Filter on port: tcp.port==443

share|improve this answer
add comment

If you don't care about the payload, then just start wireshark on a device somewhere on your network that will see all the traffic. Possibly this means setting up an AP with the wired interface connected to a hub, which your monitoring system is also connected to.

If you want the payload and you don't have the private keys, then there is basically no way to do this easily. If you could do this, then you could basically monitor any SSL traffic. If you have the private keys provided by the server, then the details are covered in the wireshark docs.

I suppose it isn't true to say you can't do it, but doing it requires steps I am not sure are possible on an IOS device. It will take quite a bit of work to actually get this setup.

  • Basically you could setup your own CA. (tinyca is really easy)
  • Install the CA certificate onto the IOS device. (may require using the IOS enterprise management tools)
  • From your CA create a key pair that where the CN corresponds to the site you want to monitor
  • Setup a SSL proxy (e.g. stunnel) using that keypair.
  • Use some monitoring tool on that proxy.
share|improve this answer
    
I've also logged traffic on port 443 with tcpdump. Any way to tell which traffic is coming from the iOS device? –  MrDatabase Aug 23 '11 at 22:56
1  
look at the source address? If is is the IP of the IOS device, then it came from the IOS device. –  Zoredache Aug 23 '11 at 23:00
    
Presumably if rvictl were used so that a tethered iOS device were using the Mac as a network interface (see e.g. developer.apple.com/library/mac/#qa/qa1176/_index.html ), there'd be no need to install anything on the device? –  Tommy Mar 11 '13 at 22:42
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.