sslsnoop.bt(8)

📦 version 0.17.0, in debian bookworm

✨ sslsnoop.bt — the SSL/TLS handshake spy 💖

okay bestie, welcome to sslsnoop.bt(8) from the System Manager's Manual section — yes it's a section 8 page, we're in the big leagues 💅

🌸 NAME 🌸

sslsnoop.bt — shows SSL/TLS handshake events. uses bpftrace/eBPF, no cap ✨

🎀 SYNOPSIS 🎀

sslsnoop.bt

🦋 DESCRIPTION 🦋

so basically sslsnoop traces the OpenSSL handshake functions and shows you the latency and the return value. it's giving performance analysis fr fr — use it to analyze your SSL/TLS performance. 🔥

it does this by dynamic tracing the uprobes in OpenSSL and related crypto libs. > heads up: it may need updating to match future changes to these functions. the vibes are load-bearing, okay 😭

and because this uses BPF, only the root user can run this tool. sorry babe, it's a whole permission thing 👑

💜 REQUIREMENTS 💜

  • CONFIG_BPF
  • bpftrace

that's the whole guest list 🫶

🌈 EXAMPLES 🌈

trace SSL/TLS handshake events and get per-line summaries:

# sslsnoop.bt

periodt. that's the example 💖

⭐ FIELDS ⭐

  • TIME(us) — when the call finished, in microseconds since the program started. little timestamp moment ✨
  • TID — the Thread ID. who did it 🧚
  • COMM — the process name. the name of the main character 💅
  • LAT(us) — latency of the call, in microseconds. how long it took bestie ⏱️
  • RET — return value of the call. did it slay or did it flop 🙈
  • FUNC — the function name. which one did it 🎀

🌸 OVERHEAD 🌸

ngl the overhead here is expected to be negligible. why? because an SSL/TLS handshake usually contains network latency, and the traced crypto functions are CPU intensive tasks — so the call frequency should be low. lowkey free. 💖

💀 SOURCE 💀

this is from bpftrace.

https://github.com/iovisor/bpftrace

also bestie, go look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. the lore 🔥

and fyi there's a bcc tool called sslsniff that can show SSL/TLS handshake event latency before sniffing the plaintext in SSL_read/write. this tool, though? it provides more detailed crypto latency distribution during the handshake event. different girl, different job 💅

https://github.com/iovisor/bcc

🐧 OS 🐧

Linux. obviously. penguin energy 🐧

🚧 STABILITY 🚧

Unstable - in development. it's in its experimental era, be gentle 😭

👑 AUTHOR 👑

Tao Xu 💖

🫶 SEE ALSO 🫶

okay that's the whole page bestie, go trace some handshakes 🌈✨

signing off — this was USER COMMANDS, dated 2021-12-28, and the page is sslsnoop.bt(8). mwah 💅💖

📦 where this page comes from