I use a product called SecureLink that through a Web Interface creates a tunneled connection from my PC to a remote server. I then run a Terminal Emulator (like Putty) and make a ssh connection to 127.0.0.2 22. I need to be able to capture the traffic on 127.0.0.2 so I can see what encryption keys are being offered by the remote server. I know Putty has some debugging/tracing ability, but I am using a different Terminal Emulator that does not. And it is getting an error that it cannot use any of the keys provide by the server. I cannot look at the PC NIC because the tunneling program is using something like TLS between the the PC and the remote server and the ssh hand shaking just shows as encrypted packets.