sslsniff \- Print data passed to OpenSSL. Uses Linux eBPF/bcc.

.B sslsniff

sslsniff prints data sent to SSL_write and SSL_read OpenSSL functions, allowing

us to read plain text content before encryption (when writing) and after

decryption (when reading).

This works reading the second parameter of both functions (*buf).

Since this uses BPF, only the root user can use this tool.

CONFIG_BPF and bcc.

.TP

#

.B sslsniff

.TP

Which function is being called (SSL_write or SSL_read)

.TP

Time of the command, in seconds.

.TP

Entered command.

.TP

Process ID calling OpenSSL.

.TP

Bytes written or read by OpenSSL functions.

This is from bcc.

.IP

https://github.com/iovisor/bcc

.PP

Also look in the bcc distribution for a companion _examples.txt file containing

example usage, output, and commentary for this tool.

Linux

Unstable - in development.

Adrian Lopez and Mark Drayton

trace(8)