Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to see /log which cipher suites are (actively) being used to establish SSL connections on Windows Server 2008 R2?
Ideally on a per request basis, like an extra column in the IIS logs.

share|improve this question
up vote 6 down vote accepted

IIS logs won't help you here, since the SSL connection is negotiated before any HTTP/application layer traffic starts flowing.

But what you can do is:

C:\Windows\system32>netsh trace start capture=yes

Trace configuration:
Status:             Running
Trace File:         C:\Users\Ryan\AppData\Local\Temp\NetTraces\NetTrace.etl
Append:             Off
Circular:           On
Max Size:           250 MB
Report:             Off

C:\Windows\system32>netsh trace stop
Correlating traces ... done
Generating data collection ... done
The trace file and additional troubleshooting information have been compiled as "C:\Users\Ryan\AppData\Local\Temp\NetTraces\".
File location = C:\Users\Ryan\AppData\Local\Temp\NetTraces\NetTrace.etl
Tracing session was successfully stopped.

You can open that ETL file with Windows Performance Analyzer, and also with NetMon. (The latter will likely be more useful to you.)

Here's a screenshot of that trace file I just generated:

(Open in new tab to see fullsize)

Netmon Trace

Edit: To find the exact cipher mode being used, locate the "HandShake: Server Hello" packets:

Netmon 2

Here is a Microsoft support article telling you how to interpret the bytes of the packet manually, but Netmon will do it for you.

You could come up with a packet trace filter that only contained packets of this nature. If there's a better way to get this data I'd like to know about it.

share|improve this answer
Close. I origally accepted the answer, but I can't work out from this what actual cipher suite is being used. "TLS 1.0" is too vague. I can see in the handshake packet a bunch of suites being offered ("TLSCipherSuites: TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA { 0x00, 0x88 } etc", but I can't tell which one is being picked. – Frederik Aug 18 '13 at 18:18
For extra credit - I'd prefer something that grabbed less data than ETL - all I need is a historical log of ciphersuites used. – Frederik Aug 18 '13 at 18:22
Edited my post. Yes the precise cipher mode is in there too. – Ryan Ries Aug 18 '13 at 21:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.