# Encrypted traffic inspection

**URL:** <https://forum.suricata.io/t/encrypted-traffic-inspection/2530>\
**Category:** Help\
**Tags:** suricata\
**Created:** [June 1, 2022, 4:37am UTC](https://forum.suricata.io/t/encrypted-traffic-inspection/2530 "2022-06-01T04:37:24Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Daryald](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@Daryald](https://forum.suricata.io/u/Daryald)\
**Post date:** [June 17, 2022, 11:33am UTC](https://forum.suricata.io/t/encrypted-traffic-inspection/2530/5 "2022-06-17T11:33:19Z")

</div>

There are two ways of detecting SSL/TLS traffic using Suricata:

1. Ja3 Hash- Good article is [here](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/inspecting-encrypted-network-traffic-with-ja3/)
2. Decrypting traffic using proxy- This is what I was talking about - using Polar Proxy. PolarProxy is capable to decrypt and re-encrypt TLS traffic in real time and also it has feature `pcapoverip` in which you can capture decrypted traffic in Wireshark or re-play it in your network using tcpreplay. This decrypted traffic can be sent to Suricata to apply detection. [This](https://www.netresec.com/?page=Blog&month=2020-01&post=Sniffing-Decrypted-TLS-Traffic-with-Security-Onion) article can help you.

---

_[View the full topic](https://forum.suricata.io/t/encrypted-traffic-inspection/2530)._