How can I monitor HTTPS traffic with Wireshark?

Question

Possible Duplicate:
How can I filter https when monitoring traffic with Wireshark?

I want to verify that the analytics package I've added to my iOS app is attempting to talk to the analytics servers (which I don't control). I think the analytics package is communicating via HTTPS. So I'd like to monitor HTTPS traffic (I don't care about decrypting it... I just want to see if it's there).

How can I do this with Wireshark? For example my current Wireshark setup (which is just a default setup) allows me to monitor traffic to http://www.duckduckgo.com but not https://www.duckduckgo.com. Do I need to change some settings in Wireshark?

Thanks!

Solution 1

Filter on port: tcp.port==443

Solution 2

If you don't care about the payload, then just start wireshark on a device somewhere on your network that will see all the traffic. Possibly this means setting up an AP with the wired interface connected to a hub, which your monitoring system is also connected to.

If you want the payload and you don't have the private keys, then there is basically no way to do this easily. If you could do this, then you could basically monitor any SSL traffic. If you have the private keys provided by the server, then the details are covered in the wireshark docs.

I suppose it isn't true to say you can't do it, but doing it requires steps I am not sure are possible on an IOS device. It will take quite a bit of work to actually get this setup.

• Basically you could setup your own CA. (tinyca is really easy)
• Install the CA certificate onto the IOS device. (may require using the IOS enterprise management tools)
• From your CA create a key pair that where the CN corresponds to the site you want to monitor
• Setup a SSL proxy (e.g. stunnel) using that keypair.
• Use some monitoring tool on that proxy.

Comments

[MrDatabase]

I've also logged traffic on port 443 with tcpdump. Any way to tell which traffic is coming from the iOS device?

[Zoredache]

look at the source address? If is is the IP of the IOS device, then it came from the IOS device.