使用 Wireshark 检查通过 SSL 的 SQL 连接的加密握手
我已经在 SQL Server 2005 服务器上实现了安全 SSL 连接。我使用“Microsoft SQL Server Management studio”连接到 SQL Server，并选中选项部分中的“加密连接”复选框。连接成功，当我查看 mgmt studio 中的连接属性时，它显示“Encrypted=Yes”。 这告诉我，我的 SSL 设置是正确的，并且我能够在安全的 SSL 加密通道上成功将 Management Studio 连接到 sql server。
问题
我想找出此连接在幕后使用的“安全功能”...因为我想确保它符合批准的标准之一 fips 140-2 anex a (http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf)，其中包含有关已批准的加密功能的信息
所以我使用wireshark来捕获流量并找出协议/握手。例如“Auth TLS”请求等...
但我找不到任何与加密相关的信息（我想不知道如何找到）。我没有看到任何 SSL 协议数据包。也许它在其他协议级别上完成所有加密工作。
那么我该如何解决这个问题呢？我有从wireshark 捕获的数据包，我可以将其提供给有兴趣查看它的任何人。 stackoverflow 可能不允许附件。
任何帮助将不胜感激。
谢谢 阿米特
I have implemented a secure SSL connection on the SQL Server 2005 server. I use the "Microsoft SQL Server Management studio" to connect to the SQL Server and I check the "Encrypt Connection" check box in the options section. The connection is successful and when I look at the connection properties in the mgmt studio, it shows me "Encrypted=Yes".
So that tells me that my SSL setup is correct and I'm able to successfully connect my management studio to sql server on a secure SSL encryption channel.
Question
I want to find out what "security functions" are being used behind the scenes on this connection...because I want to make sure it complies with one of the approved standards by
fips 140-2 anex a (http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf), which has information on approved encryption functions
So I used wireshark to capture the traffic and find out the protocols/handshakes. For instance something like 'Auth TLS' request etc...
But I couldn't find out any of the encryption related information (I guess don't know how to). I don't see any SSL protocol packets. Maybe its doing all the encryption stuff at some other protocol level.
So how I do go about figuring this out? I have the packet capture from wireshark and I can provide it to whoever is interested in looking at it. stackoverflow probably doesnt allow attachments.
Any help would be appreciated.
Thanks
Amit
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您希望输入 ssl 作为 Wireshark 过滤器以仅显示 SSL 和 TLS 数据包，并且您应该看到客户端和服务器握手并交换密码列表。如果客户端发起任何 SSL 连接，您应该在捕获的某处看到 CLIENT HELLO。您可以使用过滤器
ssl.handshake.type == 1仅显示这些数据包。也就是说，知识库文章 920995 介绍了在 FIPS 140-2 模式下运行 SQL Server 2005 SP1+ 。从您所写的内容来看，听起来您只是希望客户端和服务器选择一个允许的密码，但这不是 FIPS 140-2 的工作原理。即使您的会话选择了允许的密码，它也可能不会选择经过 FIPS 认证的密码，而认证才是重要的。
知识库文章通过以下引述阐明了这一点：
为了保证服务器使用 FIPS 认证的密码，您需要启用 FIPS 140-2 策略，如知识库文章所述。
You want to enter
sslas the Wireshark filter to show only SSL and TLS packets, and you should see the client and server handshake and exchange a list of ciphers. If the client initiates any SSL connection, you should see a CLIENT HELLO somewhere in your capture. You can show only these packets with the filterssl.handshake.type == 1.That being said, running SQL Server 2005 SP1+ in FIPS 140-2 mode is covered by KB article 920995. From what you wrote, it sounds like you are just hoping the client and server pick an allowed cipher, but that's not how FIPS 140-2 works. Even if your session chooses an allowed cipher, it may not choose a FIPS-certified cipher, and the certification is what's important.
The KB article spells it out with this quote:
To guarantee the server uses a FIPS-certified cipher, you need to enable the FIPS 140-2 policy like the KB article says.
不使用wireshark而是使用netmon，我在这里写了一篇关于这样做的文章：
http://cornasdf.blogspot.com/2010 /04/sql-server-data-in-transit-cipher.html
not using wireshark but using netmon, i have a write up on doing this here:
http://cornasdf.blogspot.com/2010/04/sql-server-data-in-transit-cipher.html
使用Wireshark，您可以通过查看数据包数据轻松判断连接是否加密。这篇文档分析的很清楚=> https://middlewareworld.org/2020 /09/04/step-by-step-ssl-handshake-with-wireshark/
Using Wireshark, you can easily find whether the connection is encrypted by looking at the packet data. This document explains the analysis clearly => https://middlewareworld.org/2020/09/04/step-by-step-ssl-handshake-with-wireshark/