0

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the .pcap file.

There are capture only filters for TCP or UDP (tcp port http) for example.

I have configured it to use tcp port https but it sill seems to have other unrelated junk data. Is there a better way of capturing HTTPs/SSL data?


Bonus, can I dump this to a network disk instead of pcap'in and storing on the same box?

6
  • 1
    Can you give an example of the kind of junk data in the capture? Mar 10, 2015 at 23:52
  • Sure, there is random TCP data that I can not follow (using follow SSL stream). I would like to not have any data except HTTPS data over TCP not all TCP data and TCP HTTPS data. I know I could capture just 443 but that would not include HTTPS over arbitrary ports correct? <p> **edit so double enter posts. Here is an example of the standard TCP traffic I want to ignore: TCP Src Port: 49623 , Dst Port 443
    – WireClowFish
    Mar 11, 2015 at 0:04
  • But, is the data to or from TCP port 443? The filter you're using is going to capture anything involving that port. Maybe the filter you want is ssl? Mar 11, 2015 at 0:05
  • SSL only as a filter is legitimate only after mass capture. I need it on pre capture.
    – WireClowFish
    Mar 11, 2015 at 0:06
  • link Working filter for TCP HTTPS
    – WireClowFish
    Mar 11, 2015 at 0:08

1 Answer 1

0

The idea here is that HTTPS traffic that travels over the Internet is confidential, a random router or person who happens to capture your packages cannot decrypt the HTTPS without the decryption key. So bottom line: Wireshark cannot decrypt HTTPS traffic.

You must log in to answer this question.