1

I'm trying to decrypt SSL at the TCP level for data that I'm sending to a remote server. The reason I'm doing this is because the remote host intermittently sends me RSTs, and I'm trying to identify a pattern. I'd like to see the contents of the last few segments before the RST happens.

I've tried mitmproxy, sslsplit, fiddler, etc. and while I am able to decrypt data at the HTTP level with these tools, what I'd really like is to see a decryption of the data in each TCP segment.

Basically, I'd like to see the equivalent of tcpdump -X, except with the data decrypted. Is there any tool/method to do this?

Improve this question
1
  • 1
    This really isn't supposed to be possible. the encryption occurs at the application layer, so anything you capture at the transport layer should be indecipherable.
    – Frank Thomas
    Jun 30, 2015 at 15:55

1 Answer 1

Reset to default
1

Not only is @FrankThomas right, but it would be useless even if you managed to do it: RSTs are like doors slammed in your face. They may occur because the server has not loaded a necessary module, because the socket is closed, because the server is behind a (Chinese, but not only) firewall, because there is some gross error (like machines with the same IP, LAN or WAN) in the implementation of the network. All of this is totally unrelated to SSL.

Your best best is to diagnose this issue from within the server, if you are allowed.

Improve this answer
12
  • Thanks MariusMatutiae and FrankThomas. Any suggestions on diagnosing the RSTs given that I have no access to the remote and the RSTs are intermittent?
    – Dave Stibrany
    Jun 30, 2015 at 16:17
  • @DaveStibrany What kind of connection to the server do you have?
    – MariusMatutiae
    Jun 30, 2015 at 16:43
  • I'm webscraping them :)
    – Dave Stibrany
    Jun 30, 2015 at 16:47
  • @DaveStibrany Doesn't make it easy; but at least it makes sense.
    – MariusMatutiae
    Jun 30, 2015 at 17:15
  • Do you think the RSTs are in response to the fact that I'm scraping them?
    – Dave Stibrany
    Jun 30, 2015 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .