I have a very specific scenario in which maschines (IoT) are communicating with a central server over websockets.

I need to inspect the websockets traffic (wss/tls) for audit and monitoring reasons (especially troubleshooting). We can't do it on the IoT or server site, since we don't maintain software.

We are able to configure the url/ip of the central server. Therefore I thought to route the traffic over a proxy/load balancer and intercept/log the traffic there in tls bridging mode. Ideally the proxy would be free (optional) and scalable (>65k connections, mandatory). I am also aware of MITM websocket proxies, who can do that for pentest and testing purposes, but I am not aware one that is scalable and ready for a high load production enviroment.

I tried different open source/free proxies, and could proxy the connections, but could not log the traffic (besides the initial http upgrade request).

I read about Application Load Balancer and the possibility to do the routing by traffic interception, but most solutions seem to use an IP Hash or sticky cookie mechanism, which isn't usefull in my case. I read into Stingray Traffic Manager, which is in principle capable of doing it (i am a bit unsure about the logging), but a free/unlimited alternative would be great.

  • What's wrong with HAProxy? It will certainly handle this with ease. – Michael Hampton Apr 4 at 18:21
  • @MichaelHampton: Probably nothing. But i was not able to log the the websocket traffic (same with nginx). Do you have any suggestions on how to get started with this case. I need to log the communication payload as plaintext in both directions – Kitano Apr 4 at 18:50
  • 1
    Terminate TLS at haproxy. Sorted. – Michael Hampton Apr 4 at 18:51
  • I am already TLS Bridging. – Kitano Apr 4 at 19:59
  • @MichaelHampton In case its a trivial maybe you have some example config, to get me on track. – Kitano Apr 5 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.