Encrypted traffic inspection

Help
5

There are two ways of detecting SSL/TLS traffic using Suricata:

  1. Ja3 Hash- Good article is here
  2. Decrypting traffic using proxy- This is what I was talking about - using Polar Proxy. PolarProxy is capable to decrypt and re-encrypt TLS traffic in real time and also it has feature pcapoverip in which you can capture decrypted traffic in Wireshark or re-play it in your network using tcpreplay. This decrypted traffic can be sent to Suricata to apply detection. This article can help you.
1 Like