53

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?

Improve this question
1

7 Answers 7

Reset to default
38

As 3molo says. If you're intercepting the traffic, then port 443 is the filter you need. If you have the site's private key, you can also decrypt that SSL . (needs an SSL-enabled version/build of Wireshark.)

See http://wiki.wireshark.org/TLS

EDIT

This answer gets a lot of traffic, so I'm adding a second option that doesn't require access to the server private key (RSA decryption is deprecated, too)

  1. Set an environment variable: SSLKEYLOGFILE to a file path inside your home directory*. (eg ~/ssl-log.txt)
  2. Open a browser and visit any TLS site. Check that the file specified is created.
  3. Launch Wireshark. Open Preferences -> Protocols -> TLS
  4. In the (Pre)-Master-Secret Log, browse to the new file.

Now capture a session as normal and you should see quickly if your session traffic is being decrypted on the fly.

This is safer because you're not holding on to a copy of the private key for the server, but naturally only works on a system where you can set the env vars before you capture.

*The session keys are also private. Someone else could also use them to decrypt the same session data, so make sure they're in a location only you can read.

Improve this answer
3
  • 4
    There is a difference between filtering and monitoring. WireShark is a monitoring tool. Filtering would have to be done with a firewall or similar.
    – txwikinger
    Commented Apr 26, 2011 at 15:13
  • 12
    @TXwik You filter what you're monitoring with WireShark....
    – Holocryptic
    Commented Apr 26, 2011 at 15:58
  • 1
    Question could be clearer ;)
    – txwikinger
    Commented Apr 27, 2011 at 20:58
48

tcp.port==443 in the filter window (mac)

Improve this answer
3
  • If you're going to post an answer, it really should be one that's substantially different to the other answers on the page already. Saying the same thing that two other answers already say isn't particularly helpful.
    – Mark Henderson
    Commented Jun 13, 2014 at 2:52
  • 11
    It is substantially different. He added the tcp prefix, which really helped me, after trying previous answers with no luck.
    – user53619
    Commented Aug 27, 2014 at 14:36
  • You mean apply that in the display filter. That small input window is called the display filter in Wireshark.
    – Remzi Cavdar
    Commented Jan 7, 2023 at 20:35
9

You can use the "tls" filter:

enter image description here

TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're looking for.

Improve this answer
4
  • 1
    clearly much better than listening for 443, since 443 is just the default for https, and one is free to use other ports (e.g. for internal traffic)
    – P Marecki
    Commented Apr 1, 2020 at 10:22
  • 2
    ssl is also a valid filter name. (tls is not in version 2.6.10 (Git v2.6.10 packaged as 2.6.10-1~ubuntu16.04.0) ) - tls has apparently replaced ssl which is right in my opinion.
    – Michael P
    Commented Apr 16, 2020 at 12:17
  • ssl works for me. However, tls does not. I am using ver2.6.10 on utuntu18.04
    – r0ng
    Commented Mar 12, 2021 at 3:43
  • It's not the same, you get more with tcp.port==443 but for websites I think using the filter tls is better.
    – Remzi Cavdar
    Commented Jan 7, 2023 at 20:38
8

"port 443" in capture filters. See http://wiki.wireshark.org/CaptureFilters


It will be encrypted data though.

Improve this answer
6

Filter tcp.port==443 and then use the (Pre)-Master-Secret obtained from a web browser to decrypt the traffic.

Some helpful links:

https://security.stackexchange.com/questions/35639/decrypting-tls-in-wireshark-when-using-dhe-rsa-ciphersuites/42350#42350

https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/

"Since SVN revision 36876, it is also possible to decrypt traffic when you do not possess the server key but have access to the pre-master secret... In short, it should be possible to log the pre-master secret to a file with a current version of Firefox, Chromium or Chrome by setting an environment variable (SSLKEYLOGFILE=). Current versions of QT (both 4 and 5) allow to export the pre-master secret as well, but to the fixed path /tmp/qt-ssl-keys and they require a compile time option: For Java programs, pre-master secrets can be extracted from the SSL debug log, or output directly in the format Wireshark requires via this agent." (jSSLKeyLog)

Improve this answer
4
  • anyway to do this on an iPhone mounted on a mac? I can inspect http traffic but not https
    – chovy
    Commented Dec 27, 2015 at 4:00
  • I would use a proxy for that @chovy. Is that an alternative? Try BURP and this link: support.portswigger.net/customer/portal/articles/…
    – Ogglas
    Commented Dec 27, 2015 at 11:35
  • is there any thing like burp but open source?
    – chovy
    Commented Dec 28, 2015 at 8:46
  • I think there are but I haven't tried any myself. Try Googling "intercepting proxy open source" and see what you find. However BURP is well known in the security community and not something shady (despite the name) so I would probably go with BURP. @chovy
    – Ogglas
    Commented Dec 28, 2015 at 8:56
0

Answering because I was looking for something similar.

When you use tcp.port, it only seems to show half the conversation. To show where 443 is either source or destination: tcp.srcport == 443 || tcp.dstport == 443

Improve this answer
0

if you want to see HTTP and HTTPS (encrypted traffic with TLS), this filter helpful http.request or tls.handshake.type == 1

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .