Analyzing HTTPS traffic – SSL/TLS basics
HTTPS is a secure version of the HTTP. The "S" means that it is secured by Secure Socket Layer/Transport Layer Security (SSL/TLS). It is used when you connect to your bank account, webmail service, or any other service that runs over HTTP and requires security.
In this recipe, we will see how it works and what can fail when we are using HTTPS communications.
Getting ready
Port mirror to the suspected device or link that forwards traffic from several devices, and start capture. HTTPS works with the TCP port 443, and this is what we should watch.
How to do it...
To monitor HTTPS sessions, perform the following steps:
- HTTPS session establishment can be done in four or five steps. It is described in the How it works... section of this recipe.
- Watch the order of the packet in the session establishment, and make sure the messages you get are according to the order shown in the following figure (in brackets you'll see what should be shown...
