---
name: "sslsniff-bpfcc"
section: "8"
platform: "linux"
package: "bpfcc-tools"
version: "0.31.0+ds-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/sslsniff-bpfcc"
---

# sslsniff-bpfcc(8)

Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.

## NAME

sslsniff - Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.

## SYNOPSIS

**sslsniff \[-h\] \[-p PID\] \[-u UID\] \[-x\] \[-c COMM\] \[-o\] \[-g\] \[-n\] \[-d\]** **\[--hexdump\] \[--max-buffer-size SIZE\] \[-l\] \[--handshake\]** **\[--extra-lib EXTRA\_LIB\]**

## DESCRIPTION

sslsniff prints data sent to write/send and read/recv functions of OpenSSL, GnuTLS and NSS, allowing us to read plain text content before encryption (when writing) and after decryption (when reading).

This works reading the second parameter of both functions (\*buf).

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bcc.

## OPTIONS

- \-h

  Print usage message.

- \-p PID

  Trace only functions in this process PID.

- \-u UID

  Trace only calls made by this UID.

- \-x

  Show extra fields: UID and TID.

- \-c COMM

  Show only processes that match this COMM exactly.

- \-o, --no-openssl

  Do not trace OpenSSL functions.

- \-g, --no-gnutls

  Do not trace GnuTLS functions.

- \-n, --no-nss

  Do not trace GnuTLS functions.

- \--hexdump

  Show data as hexdump instead of trying to decode it as UTF-8

- \--max-buffer-size SIZE

  Sets maximum buffer size of intercepted data. Longer values would be truncated. Default value is 8 Kib, maximum possible value is a bit less than 32 Kib.

- \-l, --latency

  Show function latency in ms.

- \--handshake

  Show handshake latency, enabled only if latency option is on.

- \--extra-lib EXTRA\_LIB

  Consist type of the library and library path separated by colon. Supported library types are: openssl, gnutls, nss. Can be specified multiple times.

## EXAMPLES

- Print all calls to SSL write/send and read/recv system-wide:

  \# **sslsniff**

- Print only OpenSSL calls issued by user with UID 1000

  \# **sslsniff -u 1000 --no-nss --no-gnutls**

- Print SSL handshake event and latency for all traced functions:

  \# **sslsniff -l --handshake**

- Print only calls to OpenSSL from /some/path/libssl.so

  **sslsniff --no-openssl --no-gnutls --no-nss --extra-lib** **openssl:/some/path/libssl.so**

## FIELDS

- FUNC

  Which function is being called (write/send or read/recv)

- TIME

  Time of the command, in seconds.

- COMM

  Entered command.

- PID

  Process ID calling SSL.

- LEN

  Bytes written or read by SSL functions.

- UID

  UID of the process, displayed only if launched with -x.

- TID

  Thread ID, displayed only if launched with -x.

- LAT(ms)

  Function latency in ms.

## SOURCE

This is from bcc.

-

  https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHORS

Adrian Lopez and Mark Drayton

## SEE ALSO

[trace(8)](/trace/8.md)