使用 WireShark 分析 HTTPS 流量上的 MSMQ - 没有看到 POST
我正在对 MSMQ 消息卡在出站队列（队列显示等待连接）中的问题进行故障排除。为了排除故障，我运行 WireShark 来准确查看通过网络接口推送的内容。
我已经运行了 WireShark 跟踪，我看到的似乎是完整的 SSLV3 握手（从尝试连接到服务器的本地 MSMQ 生成）：
客户端->服务器-客户端你好
服务器->客户端 - 服务器你好
客户端->服务器 - 客户端密钥交换、更改密码规范
服务器->客户端 - 更改密码规范，加密握手
在这些消息之后，我期望看到一条 POST 消息，其中客户端尝试将消息推送到服务器，以及来自服务器的某种响应，但没有任何响应。在上次更改密码规范之后，我在客户端和服务器之间看到的只是下一次 SSLV3 握手之前的一组 [ACK] 和 [SYN] 消息。具体消息是：
客户端->服务器 - TCP - [FIN, ACK]
服务器->客户端 - TCP - [ACK]
服务器->客户端 - TCP - [FIN, ACK]
客户端->服务器 - TCP - [ACK]
客户端->服务器 - TCP - [SYN]
服务器->客户端 - TCP - [SYN]
客户端->服务器 - TCP - [ACK]
然后重复握手。
我不应该期望在握手后看到 POST 消息吗？我知道 MSMQ 在通过 HTTP 发送时会对 MSMQ 消息执行 HTTP POST，因此我希望这在握手后显示为应用程序数据。
我是否需要以某种方式配置 WireShark 才能看到这些内容，因为它是通过 HTTPS 进行的？
谢谢
I am troubleshooting an issue where MSMQ messages are stuck in an outbound queue (queue saying Waiting to Connect). In order to troubleshoot I am running WireShark to see exactly what is being pushed over the network interface.
I have run a WireShark trace and what I see seems to be a full SSLV3 handshake (generated from local MSMQ trying to connect to the server):
Client->Server - Client Hello
Server->Client - Server Hello
Client->Server - Client Key Exchange, Change Cipher Spec
Server->Client - Change Cipher Spec, Encrypted Handshake
After these messages I was expecting to see a POST message with the client trying to push a message to the server, and some sort of response from the server but there is nothing. All I see between the client and server after the last Change Cipher Spec is a set of [ACK] and [SYN] messages before the next SSLV3 handshake. The specific messages are:
Client->Server - TCP - [FIN, ACK]
Server->Client - TCP - [ACK]
Server->Client - TCP - [FIN, ACK]
Client->Server - TCP - [ACK]
Client->Server - TCP - [SYN]
Server->Client - TCP - [SYN]
Client->Server - TCP - [ACK]
Then the handshake is repeated.
Should I not expect to see a POST message after the handshake? I know that MSMQ does an HTTP POST of the MSMQ messages when sent over HTTP so I was expecting this to show up as application data after the handshake.
Do I need to somehow configure WireShark to see these since it is over HTTPS?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
从您的问题中不清楚您是否已按照文档使用 Wireshark 解密 SSL （否则，您'将看到数据包，但无法查看其内容）。请注意，要实现此目的，您需要wireshark可以使用服务器的私钥，否则任何人都可以破译SSL/TLS连接（而防止这种情况正是使用SSL/TLS的目的）。
此外，您可能需要强制您的工具使用当今被认为不太健壮的密码套件。例如，现代浏览器倾向于使用 Ephemeral Diffie-Hellman (DHE) 密码套件（除非明确配置为不这样做）。 Wireshark 将无法解密使用此类密码套件的 SSL 连接。
It's not clear from your question whether you've followed the documentation to decipher SSL using Wireshark (otherwise, you'll see the packets, but won't be able to look into their content). Note that to achieve this, you need the server's private key to be available to wireshark, otherwise anyone could decipher the SSL/TLS connection (and protecting against that is exactly the point of using SSL/TLS).
In addition, you may need to force your tools to use cipher suites that are considered less robust nowadays. Modern browsers, for example, tend to use Ephemeral Diffie-Hellman (DHE) cipher suites (unless explicitly configured not to). Wireshark won't be able to decipher an SSL connection that uses such a cipher suite.
SSL 加密的全部意义在于，通过线路发送的信息是加密的，因此不可见。就我个人而言，我会非常担心您是否可以通过数据包嗅探 SSL 流量。您也许能够将wireshark配置为通过SSL显示比您当前看到的更多信息，但您永远不会看到实际内容，例如POST。
The whole point of SSL encryption is that information sent over the wire is encrypted, therefore, not visible. Personally, I would be very concerned if you could packet sniff SSL traffic. You may be able to configure wireshark to show more information over SSL than you are currently seeing, but you will never see the actual contents, such as POST.