How to decrypt TLS when using Java libraries

asked 2022-01-06 05:24:54 +0000

anjalik gravatar image

updated 2022-01-06 08:43:19 +0000

grahamb gravatar image


We have captured packets for SNMP over TLS communication and need to decrypt the encrypted application data received. By following the resource we are able to decrypt HTTPS over TLS but not SNMP over TLS.

We used SSLKEYLOGFILE method to decrypt.

Is SNMP over TLS decryption supported by Wireshark? If so, any help in this regard will be greatly appreciated.

Details: Wireshark version: Version 3.6.1 (v3.6.1-0-ga0a473c7c1ba) TLS version: TLSv1.2 SNMP request/ response port is not default 161.

Thanks, Anjali

edit retag flag offensive close merge delete


What are the SNMP endpoints (manager, agent)?

Chuckc gravatar imageChuckc ( 2022-01-06 06:02:12 +0000 )edit

Tried on manager end point. Agent side packets can also be collected if that can be decrypted.

anjalik gravatar imageanjalik ( 2022-01-06 06:04:10 +0000 )edit

The TLS code in the manager or agent is going to need to give up the keys. Have you asked the vendor if there are steps to collect them?

Chuckc gravatar imageChuckc ( 2022-01-06 07:22:23 +0000 )edit

Did you adjust the SNMP preference related to the SNMP TCP port?

Jaap gravatar imageJaap ( 2022-01-06 07:29:38 +0000 )edit

Currently TLS code in manager is java using snmp4j 3PP. Vendor, snmp4j 3PP says generic way of TLS decryption should work. No further help from the vendor. In regard to agent we don't have much control for now. I can check on that. But my understanding was using middle man approach SSLKEYLOGFILE would capture keys and same can be used to decrypt https over tls successfully. But we are not able to achieve decryption using this key file for SNMP as mentioned in problem statement.

@Jaap Regarding port change in preferance, the data on port (10161) is TCP data, if we change SNMP port to 10161, that packet is treated as SNMP and fails as it is actually SNMP with TLS on TCP channel. So, I ruled out port change

anjalik gravatar imageanjalik ( 2022-01-06 07:49:13 +0000 )edit