Tcpdump allows you to examine the headers of the TCP/IP packets. It is a good idea to run this tool occasionally to keep a watch over your network. The packets can be saved to a file and later analyzed. The tcpdump tool can be of great help when resolving networking issues. It is an industry-standard for capturing and analyzing TCP/IP packets. I'm running the exact same tcpdump command as the F5 engineer.Tcpdump is an amazing command-line tool for network sniffing. So there are application data but Wireshark does not want to display it in the Packet List. User-Agent: Mozilla/5.0 (Windows NT 6.3 WOW64 Trident/7.0 Touch rv:11.0) like Gecko Here is how it looks when reviewing an F5 technician doing it: I noticed that when I have not added the PMS key I do not have any packet that states 'Application Data' and I believe here is the problem. But I do not see any GET requests at all. When I check the follow SSL Stream I can see the decrypted data that I saw in the SSLdump.īut the thing is I want to see the packets in the packet list so I can follow the SYN/ACK packets with the GET requests. When I launch Wireshark and check the tcpdump + load the PMS I do not see any difference at all. I have also adjusted the Cache Size to 0 sessions and Cache Timeout to 1 seconds so that we do not cache anything.ĭuring the SSL Handshake we select the TLS_RSA_WITH_AES_256_CBC_SHA256 and when running the SSLdump command I get entries in the PMS log AND I can see decrypted data. I have added a custom Client SSL Profile to exclude Diffie-Hellman algorithms using the following Cipher Option: I have been testing SSLdump and I have ran into what seems to be a Wireshark problem but I'm not sure.

F5 tcpdump wireshark