Table of Contents

Cisco-SSL-Appliance-SSL-Sessions-Tool_v162

SSL Sessions Tool

Version 1.6.2

Use the SSL Sessions Tool to parse SSL session log information within an exported session log generated by a Cisco SSL Appliance. This guide provides an overview of the SSL Sessions tool and its installation. The tool can parse binary SSL session log files, filter on assorted fields, and save the data in the CSV format, for use by other applications. The SSL Sessions tool can be used in command line or in GUI mode.

This version of the SSL Sessions tool supports SSL 3.5 and later.

The SSL Sessions tool operates with SSL 3.8.x session log files by default. To work with a file exported in another version of SSL Appliance software, set the SSL Version in the tool (option available from both the command line and the GUI). For example, set the Version to 3.5 to work with session output files from SSL 3.5.x, 3.6 for 3.6.x, or 3.7 for 3.7.x, and so on.

file in Reporter format. See the Using the SSL Sessions Tool for syntax information.

Cisco SSL Appliance software is subject to licensing terms and conditions imposed by Cisco and third party software providers.

. For more information, see the following sections:

- Requirements

- Install the SSL Sessions Tool

- Using the SSL Sessions Tool

- Using the SSL Sessions Tool

Requirements

- An x86 or x86-64 personal computer running Windows or Linux. The system must be running Python 2.6.x or 2.7.x; Python 3.x is not supported. This is called the "host" system in this document.

- Python version 2.6.x or 2.7.x

- pyOpenSSL version 0.12

- wxPython 2.9 (required for UI mode)

- A Cisco SSL Appliance sslsessions output file you want to run the tool on.

Install the SSL Sessions Tool

is a version number for the package. After installation, the tool can be run from the command line or as a GUI application (requires wxPython 2.9).

Install the Package in a Linux environment

Step 1 Copy the file to the host system.

Tip You must be logged on as a user with privileges that allow software installation.

Install the Package in a Windows Environment

),

windows displays.

value field, followed by a semicolon. An example is shown next.

Note The example uses Python 2.7. The SSL Sessions tool requires Python 2.6.x or 2.7.x (Python 3.x is not supported).

window.

Verify the Installation

To verify that the SSL Diagnostics tool is installed correctly, open a command prompt and enter

You should see:

Using the SSL Sessions Tool

The SSL Session Log Tool is an application that can parse binary ssl session log files, filter on various

fields and save the data in CSV format. It can be used in command line mode or in ui mode.

In ui mode the application looks like this:

Here is an example of command-line mode:

The following options can be provided on the command-line:

Usage:

Options:

Option

Result

-h, --help

show this help message and exit

src addr wildcard filter

dst addr wildcard filter

ssl session log path

ssl session log filename wildcard filter

ssl flow state

ssl messages

dump X.509 fingerprint

dump X.509 field (e.g. CN)

error code filter

output mode: csv, report or ui (default)

timestamp filter

begin timestamp filter

end timestamp filter

lines per csv file

dump pre decision (false-positives) flows

dump hsm resigning ca info

version of sslv appliance error codes to use,

3.5, 3.6, 3.7 or 3.8

display version number and exit

.csv file in reporter format. (Space separated)

API

The event reading library for the tool is also accessible from the python installation.

This is a code example that reads the 1st log file from a command-line path argument and prints a

few fields.:

ssl_sessions.readevents

Class representing a single session log event.

Parse an ASN entry to extract SAN IP and DNS name entries.

-- String data for SAN entry.

)

Convert a network format IPv6 address into text.

-- The binary address.

Returns: IP address in string format.

Iterator that returns only events filtered by options

Reads the certificate store pem file into a dict mapping fingerprints to dicts of certificate name

values.

-- Filepath to the session log dictory.

Returns: Fingerprint to certificate info dictionary.

Reads the HSM Resigning CAs info from json format.

-- Filepath to the session log dictory.

Returns: Fingerprint to HSM info dictionary.

For Assistance

Cisco Support

.

, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

If you have any questions or require assistance with the Cisco SSL Appliance, you can also contact Cisco Support:

- Visit the Cisco Support site at http://support.cisco.com/ .

- Email Cisco Support at tac@cisco.com .

- Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.