Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a devices located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet.

So I'm trying to figure out how to get the proper filter with tcpdump.

I found help from this paper : http://www.wains.be/pub/networking/tcpdump_advanced_filters.txt
It explain how to use advance filter on IP and TCP fields.

I try this kind of filter :

tcpdump -i any 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -A -s 0 -v | grep 'Host\|id-at-commonName='

As explain in the paper, "We are matching any packet that contains data."

It work for Host field as for many other data, but I can't match the field id-at-commonName= which is in SSL field (so in the TCP Data field ?).

To be sure I captured a pcap file with the exact same filter (without the grep) and when I open it with Wireshark, I can get every Certificate Common name.

I must use a tcpdump filter because I need to get the data "on the fly".

Someone can tell why can't I see those data through tcpdump ?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The id-at-commonName label is shown by Wireshark, the wire format does not contain the text, but raw bytes. The name id-at-commonName is 03 in bytes. Following that, there is a UTF8String (12 = 0x0c) with a length of 9 bytes (localhost).

Wireshark screenshot

If you are trying to match host names from a TCP stream, keep the following in mind:

  • Certificates may be valid for multiple subjects, you may find additional names in id-ce-subjectAltName (2.5.29.17)
  • The real host that you are trying to connect to may be advertised in ClientHello handshake message via the Server Name Indication (SNI) extension.
  • Multiple messages may be combined in a single record.

Finally, note that the SSL messages may be split over multiple TCP segments, making direct analysis even harder. Perhaps it is an option to capture to write a fixed count of packets to file with rotation enabled, manually parse with tshark afterwards, and finally remove the capture?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.