Once we get there, we need to add any IP address of the flow we want Wireshark to decrypt, the corresponding port and the private key file ( default.crt for Client SSL profile in this particular lab test): Then Protocols → TLS → RSA keys list where we see a window where we can reference BIG-IP's (or server if we want to decrypt server SSL side) private key: On Mac, I clicked on Wireshark → Preferences : Initially, our capture is unencrypted as seen below: It's perfectly fine to capture resumed TLS sessions as long as full TLS handshake has been previously captured. Also, we need to make sure we capture the full TLS handshake.

Note: The 0.0 interface will capture any forwarding plane traffic ( tmm) and nnn is the highest noise to capture as much flow information as possible to be displayed on the F5 dissector header. For more details about tcpdump syntax, please have a look at K13637: Capturing internal TMM information with tcpdump and K411: Overview of packet tracing with the tcpdump utility. I first took a packet capture using : p modifier to capture only the client and server flows specific to my Client's IP address ( 10.199.3.1 Roughly, to accomplish that we can set Cache Size to 0 on SSL profile and remove (EC)DHE from Cipher Suites (see Appendix 1 for details) Private key has to be copied to Wireshark machine ( ssldump command solves this problem).Check Appendix 2 to understand how to prioritise RSA as key exchange method.Check Appendix 1 to understand how to check what's key exchange method used in your TLS connection.Check Appendix 2 to learn how to to disable BIG-IP's cache.Update: the virtual server's IP address is actually 10.199.3.145/32 2 The 4 ways to decrypt BIG-IP's traffic RSA private key decryption This is the lab topology I used for the lab test where all tests were performed:Īlso, for every capture I issued the following curl command: If that's what you want to know just skip to tcpdump -f5 ssl option section as this new approach is just a parameter added to tcpdump.Īs this article is very hands-on, I will show my lab topology for the tests I performed and then every possible way I used to decrypt customer's traffic working for Engineering Services at F5.

In this article, I will show 4 ways to decrypt traffic on BIG-IP, including the new one just release in v15.x that is ideal for TLS1.3 where TLS handshake is also encrypted. As soon as I joined F5 Support, over 5 years ago, one of the first things I had to learn quickly was to decrypt TLS traffic because most of our customers useL7 applications protected by TLS layer.

Wireshark https decrypt