I first took a packet capture using : p modifier to capture only the client and server flows specific to my Client's IP address ( 10.199.3.1 Roughly, to accomplish that we can set Cache Size to 0 on SSL profile and remove (EC)DHE from Cipher Suites (see Appendix 1 for details)

Private key has to be copied to Wireshark machine ( ssldump command solves this problem).Check Appendix 2 to understand how to prioritise RSA as key exchange method.Check Appendix 1 to understand how to check what's key exchange method used in your TLS connection.Check Appendix 2 to learn how to to disable BIG-IP's cache.Update: the virtual server's IP address is actually 10.199.3.145/32 2 The 4 ways to decrypt BIG-IP's traffic RSA private key decryption This is the lab topology I used for the lab test where all tests were performed:Īlso, for every capture I issued the following curl command: If that's what you want to know just skip to tcpdump -f5 ssl option section as this new approach is just a parameter added to tcpdump.Īs this article is very hands-on, I will show my lab topology for the tests I performed and then every possible way I used to decrypt customer's traffic working for Engineering Services at F5. In this article, I will show 4 ways to decrypt traffic on BIG-IP, including the new one just release in v15.x that is ideal for TLS1.3 where TLS handshake is also encrypted. As soon as I joined F5 Support, over 5 years ago, one of the first things I had to learn quickly was to decrypt TLS traffic because most of our customers useL7 applications protected by TLS layer.

Terraria aiw download xbox one