3 ms·
Does it decrypt TLS?
by ape4 4y ago
Does it decrypt TLS?
- amony 4y agoNo. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could be configured to do that. I've used Zeek in several organizations over the last 15 years and I have never seen it used in that way. However, Zeek running on a client computer (not on a cluster being fed from a 100 Gbit tap or SPAN) would be more scalable. And this announcement is about that. Here's a nice paper on how Zeek has been configured to monitor fast networks: https://commons.lbl.gov/download/attachments/120063098/100GIntrusionDetection.pdf https://commons.lbl.gov/download/attachments/120063098/100GI...
- dvt 4y agoIf you have the keys, it looks like it can[1][2] (a contingency is that connections must use `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`) -- it seems like it's basically the same thing as Wireshark (a network packet sniffer for debugging/forensic purposes). Not sure why everyone on HN is freaking out about it. It's actually pretty annoying to have to install Wireshark (including their capture driver) every time I need to debug over-the-wire network data. [1] https://docs.zeek.org/en/current/scripts/policy/protocols/ssl/decryption.zeek.html https://docs.zeek.org/en/current/scripts/policy/protocols/ss... [2] https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_SSL.functions.bif.zeek.html https://docs.zeek.org/en/current/scripts/base/bif/plugins/Ze...