On a devices located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet.
So I'm trying to figure out how to get the proper filter with tcpdump.
I found help from this paper : http://www.wains.be/pub/networking/tcpdump_advanced_filters.txt
It explain how to use advance filter on IP and TCP fields.
I tried this kind of filter :
$ tcpdump -i any \
'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' \
-A -s 0 -v | grep 'Host\|id-at-commonName='
As explained in the paper, "We are matching any packet that contains data."
It works for the Host
field as for many other data, but I can't match the field id-at-commonName=
which is in SSL field (so in the TCP Data field ?).
To be sure I captured a pcap file with the exact same filter (without the grep) and when I open it with Wireshark, I can get every Certificate Common name. I must use a tcpdump
filter because I need to get the data "on the fly".
Can someone explain why I can't see this data through tcpdump
?