Offensive Security Researcher & Quantum Cryptography Analyst

ssldump: Analyzing SSL/TLS Traffic at the Packet Level

Abdul Wahab Junaid
ssldump: Analyzes SSL connections

Most SSL/TLS tools I use tell me what a server offers. ssldump tells me what actually happened on the wire during a specific handshake — which record types were exchanged, what alert messages fired, and (with the right private key available) it can even decrypt and inspect the application data itself. It’s an older, niche tool compared to Wireshark, but for a focused, terminal-based look at SSL/TLS protocol-level behavior during a live capture or from a saved pcap, it’s still genuinely useful, especially in constrained environments where a full GUI packet analyzer isn’t practical.

This article covers what ssldump does, how it parses the SSL/TLS record layer, installation, syntax, real examples, and how it fits into forensic and incident response workflows.

What ssldump Does

ssldump is a network protocol analyzer specifically for SSL/TLS traffic. It can:

Architecture and Internal Working

ssldump builds on top of libpcap, the same packet capture library that powers tcpdump and Wireshark. Its processing pipeline:

  1. Capture layer — uses libpcap to either sniff live traffic on an interface or read a pre-recorded .pcap file.
  2. TCP stream reassembly — since a single TLS handshake can span multiple TCP segments, ssldump reassembles the TCP stream before attempting to parse SSL/TLS records.
  3. Record layer parser — walks each reassembled TLS record, identifying its content type (handshake, alert, application data, change cipher spec) and version.
  4. Handshake message decoder — for handshake-type records, it further parses individual message types (ClientHello, ServerHello, Certificate, ServerKeyExchange, Finished, etc.) and prints relevant fields like offered cipher suites and negotiated parameters.
  5. Decryption engine — if given a private key file matching the server’s certificate (only feasible with RSA key exchange, not ephemeral Diffie-Hellman/ECDHE), ssldump can decrypt the session and display the underlying application data.

Installation

Debian/Kali:

sudo apt update
sudo apt install ssldump -y

From source:

git clone https://github.com/adulau/ssldump.git
cd ssldump
./configure
make
sudo make install

Verify:

ssldump -v

Basic Syntax

ssldump [options] [expression]

The expression uses standard tcpdump-style filter syntax.

Command Examples

1. Live capture of TLS handshakes on an interface

sudo ssldump -i eth0 port 443

Sample output:

1 1  0.0234 (0.0234)  C>S  Handshake
      ClientHello
        Version 3.3
        cipher suites
        Unknown value 0x1301
        TLS_AES_128_GCM_SHA256
2 1  0.0567 (0.0333)  S>C  Handshake
      ServerHello
        Version 3.3
        session_id[32]=
          a1 b2 c3 d4 ...
        cipherSuite         TLS_AES_128_GCM_SHA256
3 1  0.0570 (0.0003)  S>C  Handshake
      Certificate
4 1  0.0800 (0.0230)  C>S  ChangeCipherSpec
5 1  0.0801 (0.0001)  C>S  Handshake

2. Reading from a saved pcap file

ssldump -r capture.pcap

3. Verbose handshake detail with hex dump

ssldump -r capture.pcap -A -X

4. Decrypting traffic with the server’s private key (RSA key exchange only)

sudo ssldump -i eth0 -k server_private_key.pem port 443

This only works when the connection used RSA key exchange (not ephemeral Diffie-Hellman/ECDHE), since ephemeral key exchange provides forward secrecy specifically to prevent this kind of after-the-fact decryption even with the server’s private key.

5. Filtering for a specific host

ssldump -r capture.pcap host 10.0.0.5 and port 443

6. Watching for TLS alerts specifically

ssldump -r capture.pcap -d | grep -i alert

The -d flag prints a compact one-line summary per record, which is easier to grep for specific event types like alerts or renegotiations.

Real-World Use Cases

Diagnosing TLS handshake failures: When a client reports intermittent HTTPS connection failures, capturing traffic and running ssldump against the pcap quickly reveals whether the server is sending an alert message (protocol_version, handshake_failure, certificate_unknown) that points to the exact mismatch.

Digital forensics on stored captures: When investigating an incident where TLS traffic was captured (for example, from a network tap during an active compromise), ssldump helps reconstruct the sequence and timing of handshakes, which cipher suites were negotiated, and whether any downgrade attempts occurred.

Incident response — confirming decryption capability scope: In environments using RSA key exchange (legacy configurations, some internal services), IR teams with lawful access to the server’s private key can use ssldump to decrypt and inspect historical captured traffic during a breach investigation.

Validating cipher negotiation in a lab: When testing whether a client library actually negotiates the cipher suite you expect, capturing the handshake and inspecting it with ssldump gives byte-level confirmation rather than relying on application logs.

Workflow and Tool Integration

# Step 1: capture traffic during a reproduction of the issue
sudo tcpdump -i eth0 port 443 -w capture.pcap

# Step 2: analyze the TLS handshake specifically
ssldump -r capture.pcap -A

# Step 3: cross-reference with Wireshark for a GUI view if needed
wireshark capture.pcap

I usually use ssldump for a quick terminal-based first look, especially over SSH on a remote box where I can’t run a GUI, then pull the pcap down locally into Wireshark if I need deeper visual analysis.

Performance Optimization

Troubleshooting

Best Practices and Common Mistakes

FAQ

Can ssldump decrypt TLS 1.3 traffic? No, not with a private key alone — TLS 1.3’s mandatory forward secrecy design specifically prevents this kind of passive decryption after the fact.

Is ssldump still actively maintained? It’s a mature, stable tool; most of the value today comes from its lightweight, terminal-friendly handshake analysis rather than active development.

Is ssldump a replacement for Wireshark? Not really — think of it as a specialized, scriptable command-line lens for SSL/TLS record analysis, while Wireshark remains the better tool for broader, GUI-based protocol analysis.

Lab Example

In a lab, configure an Apache server to use only RSA key exchange ciphers (for demonstration purposes), capture a handshake with tcpdump, and then:

ssldump -r lab_capture.pcap -k apache_private_key.pem -A

Compare this against a capture from a server using ECDHE ciphers to directly observe why forward secrecy prevents the same decryption technique from working.

Summary

ssldump remains a focused, lightweight way to inspect SSL/TLS handshakes at the protocol level directly from the terminal — invaluable for diagnosing handshake failures, studying cipher negotiation, and forensic reconstruction of legacy RSA-key-exchange traffic. Its decryption limitations against modern forward-secret ciphers are worth understanding well, since they explain a lot about why TLS 1.3 is fundamentally more resistant to after-the-fact traffic analysis.

References

Exit mobile version