There is a serious security issues with this method. In the end of the process, the client and the server end up deriving the same keys and secure communication starts. In this method, a sever simply sends it’s corticate and public key to it’s client and the client creates session keys and encrypt the keys with the server public key and sends encrypted keys back to the server.

The whole process is summarized in the figure below.īack in the old days, organizations used public/private(RSA) keys to exchange session keys. During TLS handshaking both the client and the server derive session keys.

After that, TLS handshaking starts in which client and server negotiate what version of SSL/TLS will be used, which cipher suite will encrypt communication and so on. When a client connects to a server, it completes TCP 3 way handshaking. These days, since SSL is outdated, organizations extensively use TLS. In other saying, TLS is just an updated, more secure version of SSL. SSL (Secure Socket Layer) and TLS (Transport Layer Security) are both cryptographic protocols that provide authentication and data encryption between clients and servers. Analysing the requests packet by packet may not give us the desired result we want when packets are encrypted with SSL/TLS. Since security is a big concern for organizations, they add a security layer to their applications. After following routine steps, if we can not fix the problem, we may need to analyse the requests packet by packet.ĪLSO READ: Steps to perform Remote Packet Capture with Wireshark If we get a reply from the client, we measure latency with ping round trip time, if everything is ok with reaching the client, we move to the next step which could be checking firewall rules for upper layer protocols for ssl/tls or other protocols. Network and system administrators first check the routine procedures.įor example checking client reachability by ping is one of the first thing to do. Sometimes, we hear complaints from our clients(end users) about how slow the network or the server is. End users(clients) mostly use their browsers as client application to interact with the server. In return, the server processes the request and return an answer back. A Client creates a request and sends it to the server. In modern days, most of applications used in an organization are web based and in Client/Server architecture. Getting started with Wireshark to Decrypt SSL/TLS

Wireshark log