Hey all I have a weird question (first time poster so forgive me if this is super newb)...

I am wanting to see the inner workings of a SSL/TLS connection between a client and a server at the packet level (in the clear) in order to learn. Is there a way to do this where I will see all of the traffic including the handshake?

Should I just setup a webserver that uses SSL/TLS and then use ssl strip & tcpdump to grab the packet capture? Will that even work in order to grab the full connection in the clear?

I am not super familiar with the SSL/TLS stack and I would like to do this in order to learn how it works at a lower level.

  • $\begingroup$ This is not a question about computer science concepts, but about technology. I'm not sure where to send you; Super User may be the right site, but please check their scope. $\endgroup$
    – Raphael
    Jul 2, 2015 at 8:01

1 Answer 1


Sure. Yes, you can capture the packets and view them. That'll work. It's a useful, informative exercise.

You can use Wireshark (or some other packet capture tool) to capture the packets involved in the TLS handshake and view the captured packets. It'll show you the raw bytes, and also decode the handshake messages for you. Wireshark has a nice GUI that might make it easier to use, so I recommend that as your first choice, if you haven't done anything like this before.

I don't see any reason why you'd use SSL strip.

  • $\begingroup$ Wouldn't that only show me the inner workings of the handshake and not give me anything in regards to the remainder of the connection (as the rest of the connection would be encrypted)? $\endgroup$ Jul 2, 2015 at 19:22
  • $\begingroup$ @MikeJohnson, if you want to see the encrypted data, you can give Wireshark your private key and it will decrypt it for you. $\endgroup$
    – D.W.
    Jul 2, 2015 at 20:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.