tcpflow and ssldump

Posted on Fri, 20 Jul 2007

I'd like to introduce you all to two very useful tools I've been using lately while debugging SSL and non-cleartext logins. These two tools are what I shall refer to as “line monitors”, they let you see the protocol interactions as they happen. Unlike a network sniffer/protocol analyser/etc, a line monitor generally concerns the user with the application level interactions. Line monitor is a term I picked up while reading about ASN.1, and I think its a term used mostly with that technology.

The two tools are tcpflow, and ssldump. Both are a simple apt-get away to Debian users. Mac OS X users can get tcpflow via Fink, or both from Darwin Ports.

Read more...