sslsnoop.bt(8)

📦
version 0.27.0 · 2 versions
  • 0.27.0 · alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 0.20.2 · ubuntu noble
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ sslsnoop.bt(8) ✨

System Manager's Manual 💅 okay bestie, this is the page for sslsnoop.bt, the tool that spies on your SSL/TLS handshakes 🫶

🔐 NAME 🔐

sslsnoop.bt — Show SSL/TLS handshake events. It runs on bpftrace/eBPF 🧚

📜 SYNOPSIS 📜

sslsnoop.bt

💖 DESCRIPTION 💖

okay so sslsnoop traces the OpenSSL handshake functions and shows you the latency and the return value for each one ✨ which makes it perfect for poking at SSL/TLS performance 🔥

this tool works by dynamic tracing the uprobes in OpenSSL and related crypto libs 🦋 the catch is that it might need updating when those functions change in the future, so keep that in mind 🙈

and because it runs on BPF, only the root user can use it 👑 no cap, that's a hard rule.

🛠️ REQUIREMENTS 🛠️

you'll need CONFIG_BPF and bpftrace 🌸

🎀 EXAMPLES 🎀

Trace SSL/TLS handshake events, printing per-line summaries 🍓

# sslsnoop.bt

🔍 FIELDS 🔍

  • TIME(us) — the time the call finished, in microseconds since the program started ⏰
  • TID — the thread ID 🧵
  • COMM — the process name 🌈
  • LAT(us) — how long the call took, in microseconds ⚡
  • RET — the return value of the call 💜
  • FUNC — the function name 🦋

🐢 OVERHEAD 🐢

ngl, this one is giving chill vibes 🫶 a SSL/TLS handshake usually has network latency baked in, and the crypto functions being traced are CPU intensive tasks. so the call frequency should be low, and the overhead of this tool is expected to be negligible ✨

🌐 SOURCE 🌐

this is from bpftrace 💖

https://github.com/bpftrace/bpftrace

also go check the bpftrace distribution for a companion _examples.txt file 📚 it has example usage, output, and commentary for this tool, so it's lowkey the best cheat sheet 🎀

there's also a bcc tool called sslsniff 🦋 it can show SSL/TLS handshake event latency before sniffing the plaintext in SSL_read/write. this tool gives you more detailed crypto latency distribution during the handshake event, so they're besties but not twins 🙈

https://github.com/iovisor/bcc

🐧 OS 🐧

Linux 🌈

🧪 STABILITY 🧪

Unstable - in development. it's still cooking, so don't be shocked if things shift 🙈

👩‍💻 AUTHOR 👩‍💻

Tao Xu 🫶

👀 SEE ALSO 👀

biosnoop.bt(8) 💜

okay that's the whole page, bestie 💅✨ it's the USER COMMANDS section, dated 2021-12-28, for sslsnoop.bt(8) 🎀🦋

📦 where this page comes from