Analysis Characteristics around wireshark https packets decrypting
Before (a) https decryption
1, protocol type: two kinds of
(1) the TCP (the fourth layer, the transport layer)
(2) the SSL / the TLS (the fifth layer, the application layer encryption and decryption)
2, where the application layer data packet characteristics
(1) Protocol ( protocol) of SSL / TLS protocol packets.
(2) Length (data length) is greater than 66 (rounded 70). Is the packet length is larger than 70, the application layer will contain data. Wireshark intermediate interface and a multi-position will Sockets Layer Layer Secure.
(3) Info (information) of a class of application layer custom data (Application Data), two types of application layer data keys certificate (Server Hello, Certificate, Server Key Exchange, Server Hello Done , etc.)
After (b) https decryption
1, protocol type, and variations: three kinds of
(1) the TCP (the fourth layer, the transport layer)
(2) the SSL / the TLS (the fifth layer, the application layer encryption). Change: only two types of application layer data certificate keys, without changing protocols, and substantially uniform before decryption.
(3) HTTP (fifth layer, application layer, custom data). Change: a class of the application layer from the original data converted from custom, and the background wireshark packet corresponding to light green,
expressly tabs (Decrypted SSL data) decrypted bottom interface.
2, where the application layer data packet characteristics
(1) Protocol (protocol) for the HTTP protocol packets.
(2) Length (data length) is greater than 66 (rounded 70). Is the packet length is larger than 70, the application layer will contain data. And an intermediate position of the interface will wireshark Secure Sockets Layer 1 layer and 1-n a plurality Hypertext Transfer Protocol layer.
(3) Info (information) defined for a class of application layer data from the Application Data described, it becomes a specific address http requests; two types of application layer data described in the certificate keys, substantially constant.
